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About the Documentation 


IN THIS SECTION 


Documentation and Release Notes | xi 
Documentation Conventions | xi 


Documentation Feedback | xiv 


Requesting Technical Support | xiv 


This guide describes how to activate, install, manage, and monitor licenses on Juniper Networks devices. 
Note that this guide includes instructions for two different licensing portals: 


e Juniper Agile Licensing (JAL) portal—Available at: https://license.juniper.net/licensemanage/. Use the 
JAL portal to activate and manage licenses on most Juniper products. 


Licensing Management System (LMS)— Available at: https://Ims.juniper.net/Icrs/license.do. Use the LMS 
to activate and manage licenses on Application Acceleration, Firewall/IPSec VPN, Identity and Policy 
Control (IPC) SRC, IDP Appliances, Junos Space, NSM, STRM/JSA, SBR Carrier, WLC Series and WLM 
Series. 


Documentation and Release Notes 


To obtain the most current version of all Juniper Networks® technical documentation, see the product 


documentation page on the Juniper Networks website at https://www.juniper.net/documentation/. 


If the information in the latest release notes differs from the information in the documentation, follow the 


product Release Notes. 


Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. 
These books go beyond the technical documentation to explore the nuances of network architecture, 
deployment, and administration. The current list can be viewed at https://www.juniper.net/books. 


Documentation Conventions 


Table 1 on page xii defines notice icons used in this guide. 


xi 


Table 1: Notice Icons 


Meaning 


Informational note 


Caution 


Warning 


Laser warning 


Tip 


Best practice 


oO > > P Oo: 


Description 


xii 


Indicates important features or instructions. 


Indicates a situation that might result in loss of data or hardware 


damage. 


Alerts you to the risk of personal injury or death. 


Alerts you to the risk of personal injury from a laser. 


Indicates helpful information. 


Alerts you to a recommended use or implementation. 


Table 2 on page xii defines the text and syntax conventions used in this guide. 


Table 2: Text and Syntax Conventions 


Convention 


Bold text like this 


Fixed-width text like this 


Italic text like this 


Description 


Represents text that you type. 


Represents output that appears on 
the terminal screen. 


e Introduces or emphasizes important 


new terms. 
e Identifies guide names. 


e Identifies RFC and Internet draft 
titles. 


Examples 


To enter configuration mode, type 
the configure command: 


user@host> configure 


user@host> show chassis alarms 


No alarms currently active 


e A policy term is a named structure 
that defines match conditions and 
actions. 


e Junos OS CLI User Guide 


e RFC 1997, BGP Communities 
Attribute 


Table 2: Text and Syntax Conventions (continued) 


Convention 


Italic text like this 


Text like this 


< > (angle brackets) 


| (pipe symbol) 


# (pound sign) 


[ ] (square brackets) 


Indention and braces ( { }) 


; (semicolon) 


GUI Conventions 


Description 


Represents variables (options for 
which you substitute a value) in 
commands or configuration 
statements. 


Represents names of configuration 
statements, commands, files, and 
directories; configuration hierarchy 
levels; or labels on routing platform 
components. 


Encloses optional keywords or 
variables. 


Indicates a choice between the 
mutually exclusive keywords or 
variables on either side of the symbol. 
The set of choices is often enclosed 
in parentheses for clarity. 


Indicates a comment specified on the 
same line as the configuration 
statement to which it applies. 


Encloses a variable for which you can 
substitute one or more values. 


Identifies a level in the configuration 
hierarchy. 


Identifies a leaf statement at a 
configuration hierarchy level. 


xiii 


Examples 


Configure the machine’s domain 


name: 


[edit] 
root@# set system domain-name 
domain-name 


e Toconfigure a stub area, include 
the stub statement at the [edit 
protocols ospf area area-id] 
hierarchy level. 


e The console port is labeled 
CONSOLE. 


stub <default-metric metric>; 


broadcast | multicast 


(string1 | string2 | string3) 


rsvp { # Required for dynamic MPLS 
only 


community name members [ 
community-ids ] 


[edit] 
routing-options { 
static { 
route default { 
nexthop address; 
retain; 


xiv 


Table 2: Text and Syntax Conventions (continued) 


Convention Description Examples 
Bold text like this Represents graphical user interface e Inthe Logical Interfaces box, select 
(GUI) items you click or select. All Interfaces. 


e Tocancel the configuration, click 


Cancel. 
> (bold right angle bracket) Separates levels in a hierarchy of In the configuration editor hierarchy, 
menu selections. select Protocols>Ospf. 


| Documentation Feedback 


We encourage you to provide feedback so that we can improve our documentation. You can use either 


of the following methods: 


e Online feedback system—Click TechLibrary Feedback, on the lower right of any page on the Juniper 
Networks TechLibrary site, and do one of the following: 


ga Feedback - 


Is this page helpful? 


e Click the thumbs-up icon if the information on the page was helpful to you. 


e Click the thumbs-down icon if the information on the page was not helpful to you or if you have 
suggestions for improvement, and use the pop-up form to provide feedback. 


e E-mail—Send your comments to techpubs-comments@juniper.net. Include the document or topic name, 
URL or page number, and software version (if applicable). 


| Requesting Technical Support 


Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). 
If you are a customer with an active Juniper Care or Partner Support Services support contract, or are 


XV 


covered under warranty, and need post-sales technical support, you can access our tools and resources 
online or open a case with JTAC. 


e JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User 
Guide located at https://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf. 


e Product warranties—For product warranty information, visit https://www.juniper.net/support/warranty/. 


e JTAC hours of operation—The JTAC centers have resources available 24 hours a day, 7 days a week, 
365 days a year. 


Self-Help Online Tools and Resources 


For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called 
the Customer Support Center (CSC) that provides you with the following features: 


Find CSC offerings: https://www.juniper.net/customers/support/ 


Search for known bugs: https://prsearch.juniper.net/ 


Find product documentation: https://www.juniper.net/documentation/ 


Find solutions and answer questions using our Knowledge Base: https://kb.juniper.net/ 


Download the latest versions of software and review release notes: 


https://www.juniper.net/customers/csc/software/ 


Search technical bulletins for relevant hardware and software notifications: 
https://kb.juniper.net/InfoCenter/ 


e Join and participate in the Juniper Networks Community Forum: 
https://www.juniper.net/company/communities/ 


e Create a service request online: https://myjuniper.juniper.net 
To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: 


https://entitlementsearch.juniper.net/entitlementsearch/ 


Creating a Service Request with JTAC 


You can create a service request with JTAC on the Web or by telephone. 
e Visit https://myjuniper.juniper.net. 
e Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico). 


For international or direct-dial options in countries without toll-free numbers, see 
https://support.juniper.net/support/requesting-support/. 
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Flex Software Subscription Model 


The Flex Software Subscription Model is a framework, set of policies, and tools that help unify and thereby 
simplify Juniper product-driven licensing and packaging. 


The major components of the framework are: 


e A focus on customer segments (enterprise, service provider, and cloud) and use cases for Juniper Networks 


hardware and software products. 


e The introduction of subscription licenses and subscription portability for all Juniper Networks products 
including Junos OS, Contrail, and Juniper cloud-based services. 


e The introduction of a common, three-tiered model (standard, advanced, and premium) for all Juniper 


Networks software products. 


Getting Started 


As a customer ordering a Juniper Networks product under the Flex Software Subscription Model that 
includes hardware, you order: 


e The hardware platform that includes the standard license. 
e The customer support package that fits your needs. 


e The advanced or premium subscription licenses, according to your use case. These subscription licenses 
include embedded customer support. 


As a customer ordering a Juniper Networks software product, you order: 


e The standard, advanced, or premium subscription license, according to your use case. These subscription 
licenses include embedded customer support. 


Understanding the Three-Tier Model 


As new hardware platforms become available under the Flex Software Subscription Model, you can 
customize your purchase using one of the following three models: 


e Standard License 


The standard license includes the hardware platform and a license to use the software with the standard 
feature set. Standard Return Material Authorization (RMA) policies apply with no changes in case of 
hardware failure. Customer support is ordered separately as you select your preferred hardware support 
policy and support for the standard software features. For more information about support policy, see 
Contact Support. The hardware platform does not require a separate license, and the software right-to-use 
(RTU) license is perpetual for the licensed features. 


Advanced License 


The advanced license includes the subscription-based license to use the advanced software features. 
The license term is 1 year, 3 years, or 5 years. Customer support for the software features is included. 
These features differ by use case and platform. For example, to view the list of features for the QFX 
Switches, see QFX switch device class and SKUs. 


Premium License 


The premium license includes the subscription-based license to use the Junos OS software features. 
The license term is 1 year, 3 years, or 5 years. Customer support for the software features is included. 
These features differ by use case and platform. The premium license is a superset and includes all the 
features from the advanced license and additional features. For example, to view the list of features for 
the QFX Switches, see QFX switch device class and SKUs. 


Figure 1: Three-Tier Model for the Flex Software Subscription Model 
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Understanding Subscription Licenses 
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All advanced and premium licenses are offered as subscriptions under the Flex Software Subscription 
Model. Subscription licenses are available in 1-year, 3-year, or 5-year terms. After the order fulfilment, 
the subscription period begins after the completion of a 30-day grace period. 


Table 3 on page 4 describes the subscription terms for purchase and number of months to use the license. 


Table 3: Subscription Terms Details 








Subscription Terms Number of Months for the License 
1-year | 13 months 

| 3-year 7 37 months 

| 5-year 7 61 months 















































Flex Software Subscription licenses include the following attributes: 


e Specific products might offer a subset of these licenses. At the end of the term, you have three options: 
e You can renew the subscription, to continue to use the features and scale granted under the license. 
e You can order a replacement subscription. 


Upgrading and downgrading the subscription models is supported. In both cases, subscription models 
are processed as a new order, and you might use the features and scale granted under the new license. 


For example, you have a 5-year subscription and you want to downgrade to a 3-year subscription or 
the other way around. 


e You might decline to renew or purchase a replacement subscription. In this case, you may no longer 
use the features and scale granted under the expired subscription. You can continue to use the hardware 
and any software features which are granted under the perpetual license. 


e Alternatively, when an advanced subscription term expires, your needs may require an upgrade to the 
premium subscription term. 


Subscription licenses include Juniper customer support for software features as part of the subscription 
license, unless customer support is provided by a Juniper partner directly. There is no need to order a 
separate customer support policy for the advanced and premium licenses. 


Premium licenses include all the features in the premium and advanced licenses. 


Subscriptions may be ordered at any time. 


e New software features may be available over time with new software versions. 


Subscription licenses are portable for similar devices. 


Subscriptions are cancelable at the end of the term. 


e Renewals are not automatic. 


License Portability 


Subscription licenses are portable. This means that if you buy a new similar hardware platform, then you 
can port the subscription license. You can stop using the license on one hardware platform and move it 
to another hardware platform. This portability allows you to balance features across hardware platforms 
in the network without having to buy extra feature licenses. 
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The Flex Software Subscription Model supports the following Juniper products: 


ACX710, ACX5448, ACX5448-D, and ACX5448-M 


Table 4 on page 7 describes the licensing support for the ACX710, ACX5448, ACX5448-D, and 
ACX5448-M Universal Metro Routers. 


Figure 2 on page 6 shows ACX710, ACX5448, ACX5448-D, and ACX5448-M features for the Flex 
Software Subscription Model Three-Tier (standard, advanced, and premium licenses). 


Figure 2: ACX710, ACX5448, ACX5448-D, and ACX5448-M Three-Tiered Model for the Juniper Flex 
Program 


Advanced Features License Premium Features License 


Layer 2 VPN (Pseudowire Emulation With the premium license, you can 
: Edge to Edge, VPLS, EVPN), Layer 3 VPN, use all the advanced features that are 
Licenses ? | Support timing, E-OAM, HQoS, telemetry, supported on ACX5448-D and 
and RFC2544 ACX5448-M Universal Metro Routers 
with full platform scale of FIB and VPNs. 
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Table 4: Supported Features on ACX710, ACX5448, ACX5448-D, and ACX5448-M 


License Model 


Standard license for 
integrated SKUs 


Advanced license for 
integrated and advanced 
SKUs 


Premium license for 
integrated and premium 
SKUs 


Use Case Examples or 
Solutions 


Basic Layer 2 aggregation 
and Layer 3 


Layer 2 or Layer 3 
aggregation, Distributed 
Access Architecture (DAA), 
Converged Interconnect 
Network (CIN), mobile 
backhaul (BH), fronthaul 
(FH), or midhaul (MH), and 
next-generation fiber to the 
home (NG-FTTH) 


Provider edge 


Detailed Features for 
Fabric Management 


Layer 2 (VLAN and Q-in-Q), 
Layer 3 basic routing (with 
IGP only), and port queues 


Layer 2 VPN (Pseudowire 
Emulation Edge to Edge, 
VPLS, EVPN), Layer 3 VPN, 
timing, EEOAM, HQoS, 
telemetry, and RFC2544 


With the premium license, 
you can use all the 
advanced features that are 
supported on ACX7 10, 
ACX5448, ACX5448-D, 
and ACX5448-M Universal 
Metro Routers with full 
platform scale of FIB and 
VPNs. 


Scale 


Default Layer 2 scale and 8 
queues per port 


32 VRFs and 8 NG-MVPN 


32+ VRFs and 8+ 
NG-MVPN 


For ACX710, ACX5448, ACX5448-D, and ACX5448-M Universal Metro Routers, the Flex Software 
Subscription Model supports subscription portability for the cloud, enterprise, and service provider segments. 


Contrail Enterprise Data Center 


Table 5 on page 8 describes licensing support for fabric management on Contrail Enterprise Data Center. 


Figure 3 on page 8 shows Contrail Enterprise Data Center features for the Flex Software Subscription 


Model Three-Tier (standard, advanced, and premium licenses). 


Figure 3: Contrail Enterprise Multicloud 


FABRIC MANAGEMENT PRIVATE CLOUD AUTOMATION PUBLIC CLOUD AUTOMATION 








Advanced security: Policy generation, Layer 7 host-based firewall 


EREMIUM Designer for infrastructur Premium feature set for 
esigner for infrastructures, ern teeta S200) High availability for VPCs 


topology, and services virtualizing computation 


PaaS or virtualized 


Data center integration: compute pods with OSH 


Firewall based on ESXi and 
Nutanix orchestrators Red Hat OpenStack 
VM orchestration 


Direct connect for VPCs 
in a public cloud environment 


IND \/A\N (C1 =1B) 





Tag-based security: Policy enforcement and visualization 


Data center automation: Advanced analytics and visualization 


Basic analytics, operations, 


STANDARD No standard features for private and public cloud automation use cases 


and troubleshooting 


9300687 





Table 5: Supported Features on Fabric Management on Contrail Enterprise Data Center 


Contrail Enterprise Data Center License Model Detailed Features for Fabric Management 


Standard Fabric management: Basic analytics, operations, and 


troubleshooting 


Advanced Tag-based security: Policy enforcement and visualization 


Data center integration: Firewall based on ESXi and 
Nutanix orchestrators 


Data center automation: Advanced analytics and 
visualization 


Fabric management: Basic analytics, operations, and 
troubleshooting 


Table 5: Supported Features on Fabric Management on Contrail Enterprise Data Center (continued) 


Contrail Enterprise Data Center License Model 


Premium 


Detailed Features for Fabric Management 


Designer for infrastructure, topology, and services 


Advanced security: Policy generation, Layer 7 host-based 
firewall 


Data center integration: Firewall based on ESXi and 
Nutanix orchestrators 


Data center automation: Advanced analytics and 
visualization 


Fabric management: Basic analytics, operations, and 
troubleshooting 


For fabric management, the Flex Software Subscription Model supports subscription portability for the 


cloud, enterprise, and service provider segments. 


Table 6 on page 9 describes licensing support for private cloud automation on Contrail Enterprise Data 


Center. 


Table 6: Supported Features on Private Cloud Automation on Contrail Enterprise Data Center 


Contrail Enterprise Data Center License Model 


Advanced 


Premium 


Detailed Features for Private Cloud Automation 


Tag-based security: Policy enforcement and visualization 


Data center automation: Advanced analytics and 
visualization 


Red Hat OpenStack VM orchestration 


PaaS or virtualized compute pods with OSH 


Advanced security: Policy generation, Layer 7 host-based 
firewall 


PaaS or virtualized compute pods with OSH 
Premium feature set for virtualizing computation 
Tag-based security: Policy enforcement and visualization 


Data center automation: Advanced analytics and 
visualization 


Red Hat OpenStack VM orchestration 
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For private cloud automation, the Flex Software Subscription Model supports subscription portability for 
the cloud, enterprise, and service provider segments. 


Table 7 on page 10 describes licensing support for public cloud automation on Contrail Enterprise Data 
Center. 


Table 7: Supported Features on Public Cloud Automation on Contrail Enterprise Data Center 


Contrail Enterprise Data Center License Model Detailed Features for Public Cloud Automation 


Advanced Tag-based security: Policy enforcement and visualization 


Data center automation: Advanced analytics and 
visualization 


Direct connect for VPCs in a public cloud environment 


Premium Advanced security: Policy generation, Layer 7 host-based 
firewall 


Direct connect for VPCs in a public cloud environment 
High availability for VPCs 
Tag-based security: Policy enforcement and visualization 


For public cloud automation, the Flex Software Subscription Model supports subscription portability for 
the cloud, enterprise, and service provider segments. 


Contrail Cloud and Contrail Networking 


Table 8 on page 11 describes the licensing support with use case examples for the Contrail Cloud and 
Contrail Networking. 


Figure 4 on page 11 shows Contrail Cloud and Contrail Networking features for the Three-Tier (standard, 
advanced, and premium licenses). 
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Figure 4: Contrail Cloud and Contrail Networking 


Advanced 2: Advanced routing capabilities, advanced security, distributed or edge compute, 
high performance VNFs, and micro segmentation 
Advanced 2 Software License 


(includes customer support) 5 . ae : 
BGPaa&, data plane encryption, DPDK vRouter, flow visualization, Supported Device Class 


host-based firewall, remote compute, security policies, and C1—Compute node 
SmartNIC offload C2—Extra storage (optional) 


Advanced 1: Advanced routing capabilities, advanced security, distributed or edge compute, 
high performance VNFs, and micro segmentation 


Advanced 1 Software License 


(includes customer support) 


BGPaa&, data plane encryption, DPDK vRouter, flow visualization, Supported Device Class 
host-based firewall, remote compute, security policies, and SmartNIC offload] | C1—Compute node 


Standard: Basic requirements, centralized data center with no distribution, control plane VNF with 

low throughput. and legacy data plane VNF with limited requirements 
S)tlalel= lee} 
Software 
License 


Customer 
Support 


ACLs, kernel vRouter, Layer 4 policies, service chaining, Supported Device Class 
and SR-IOV forwarding C1—Compute node 


USS) Sa O7 NS) a SUBSCRIPTION 








301142 


FEATURES PERPETUAL 


Table 8: Supported Features on Contrail Cloud and Contrail Networking 


Use Case Examples or Supported 
License Model Solutions Detailed Features Device Class | License SKUs 
| 
Standard Basic requirements, ACLs, kernel vRouter, Layer 4 C1—Compute | S-CSP-S1-C1- 
centralized data center policies, service chaining, and node 1/3/5/P 
with no distribution, SR-IOV forwarding 


control plane VNF with 
low throughput. and 
legacy data plane VNF 
with limited 
requirements 





Advanced 1 Advanced routing BGPaa&, data plane encryption, C1—Compute S-CSP-A1-C1- 
capabilities, advanced DPDK vRouter, flow visualization, | node 1/3/5/P 
security, distributed or host-based firewall, remote 
edge compute, high compute, security policies, and 
performance VNFs, and | SmartNIC offload 

micro segmentation 





















































Table 8: Supported Features on Contrail Cloud and Contrail Networking (continued) 








Use Case Examples or _ Supported 
License Model Solutions Detailed Features Device Class | License SKUs 
Advanced 2 Advanced routing BGPaa&, data plane encryption, C1i—Compute = S-CSP-A2-C1-1/3 
capabilities, advanced DPDK vRouter, flow visualization, | node 
security, distributed or host-based firewall, remote S-CSP-A2-C2-1/3 
edge compute, high compute, security policies, and C2—-Extra 
performance VNFs, and | SmartNIC offload eyaldee 
(optional) 


micro segmentation 
































cRPD 


Figure 5 on page 12 shows cRPD features for for Flex Software Subscription Model. 


Figure 5: cRPD 


Routing Stack for Host Route Reflector 
cRPD Routing cRPD Routing 






Premium Software License 


(Tate; [U(e {=tome0 f=) Co)gnt-1mn-J0) 0) ole) a0) 


Advanced: Layer 3 deployments 
with MPLS or SR starting at the host 


Advanced Software License 


(includes customer support) License for Route Reflector 


Includes the features from Standard tier 
along with BGP sharding, and enhanced MPLS 


Standard: Layer 3 to the IP host Standard: Route Reflector or Route Server 
Standard Software License 


((Tates[U(e {=tome01<) Co)gnt-1an-10] 0) ole) a0) 


Automation and programmability, Automation and programmability, BGP, 
BGP, IGP, LSP, MPLS, and telemetry BGP sharding, IGP, MPLS, and telemetry 


No features in Advanced Software ' 


USE CASE 
FEATURES 
SUBSCRIPTION 
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Table 9 on page 13 describes the licensing support for Routing Stack for Host on containerized routing 
protocol process (cRPD). 


Table 9: Routing Stack for Host Features on cRPD 


License Model 


Advanced license 


Standard license 


Routing Stack for 
Host SKUs 


S-CRPD-A-HR-1/3/5 
S-CRPD-100-A-HR-1/3/5 
S-CRPD-1K-A-HR-1/3/5 
S-CRPD-10K-A-HR-1/3/5 


S-CRPD-S-HR-1/3/5 
S-CRPD-100-S-HR-1/3/5 
S-CRPD-1K-S-HR-1/3/5 
S-CRPD-10K-S-HR-1/3/5 


Use Case Examples 
or Solutions 


Layer 3 deployments 


with MPLS or SR 
starting at the host 


Layer 3 to the IP host 


Detailed Features 


Includes the features 
from Standard tier 
along with BGP 
sharding, and 
enhanced MPLS 


Automation and 
programmability, 
BGP, IGP, LSP, MPLS, 


and telemetry 
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Scale 


Without scale 
restrictions on BGP 
peers and RIB 


16 BGP Peers and 
4M RIB 


Table 10 on page 13 describes the licensing support with use case examples Route Reflector on 


containerized routing protocol process (cRPD). 


Table 10: Route Reflector Features on cRPD 


License Model 


Standard license 


Route Reflector 
SKUs 


S-CRPD-S-RR-1 
S-CRPD-S-RR-3 
S-CRPD-S-RR-5 


Use Case Examples 
or Solutions 


Route Reflector or 
Route Server 


Table 11 on page 14 shows cRPD SKU definition. 


Detailed Features 


Automation and 
programmability, 
BGP, BGP sharding, 
IGP, MPLS, and 
telemetry 


Scale 


No scale restrictions 
on RIB 


14 


Table 11: cRPD SKU Definition 


SKU SKU Character Description 


S-CRPD-S/A-HR-1/3/5 S—Software 
S-CRPD-100/1K/10K-S/A-HR-1/3/5 | CRPD—Product name cRPD 
S-CRPD-S-RR-1/3/5 S—Standard software subscription 
A—Advanced software subscription 
HR—Host Routing 
RR—Route Reflector 
100—Bundle of 100 software licenses 
1K—Bundle of 1000 software licenses 
10K—Bundle of 10000 software licenses 


1/3/5—Subscription term 1, 3, or 5 years 


To add, delete, and managing license, refer Managing Licenses. 


Contrail Service Orchestration 


Table 12 on page 15 describes the standard and advance license model support with use case examples 
for the Contrail Service Orchestration (CSO) software. Table 13 on page 16 lists the supported devices 
categorized into device classes. 


Figure 6 on page 15 shows CSO features for the standard and advanced licenses. 


Figure 6: Contrail Service Orchestration 


¢ Advanced (A1) includes Standard (S1) 
¢ Per Device/ Device Class Based 


[e<Je) 
Software 


Next-generation 
Firewall 


Hybrid WAN 


Junos OS software + SRX 
Series with Junos Software 
Base (JSB) or NFX or vSRX)} 
standard + feature licenses 


Junos OS software + SRX 
Series with Junos 
Software Base (JSB) or vSRX 
standard + feature licenses 


Platform 
Software 


Separately 
Purchased 


CPE/Spoke: SRX300 line 
of devices, SRX550M, 
NFX150, NFX250, and vSRX_f 


Hub: MX104, MX240, 
MX480, MX960, and vSRX 


SRX300 line of 
devices and vSRX 


Platform 
Hardware 





¢ Tiered Model —Standard and Advanced includes Juniper Software Advantage Support 


Junos OS software + 
feature licenses 


=> cle] 0a =>, <r 100 
EX4300, EX4600 
and EX4650 
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CSO ADVANCED - A1 


Next- 
(ereVal-le-li(ela) 
Firewall 


Junos OS software + 
SRX Series with Junos 
Software Enhanced (JSE) 
or NFX or vSRX + 
advanced feature license 


CPE/Spoke: SRX300 line 
of devices, SRX550M, 
NFX150, NFX250, and vSRXjf 


Hub: SRX1500, SRX4100, 
SRX4200, MX104, MxX240, 
MX480, MX960, and vSRX 


g300866 


Table 12 on page 15 describes the Flex Software Subscription Model support with use case examples for 


the Contrail Service Orchestration (CSO) software. 


Table 12: CSO SKUs for Standard and Advanced License Model 


License Use Case Examples or 

Model Solutions Features Supported 
Standard Hybrid WAN, 

license next-generation firewall 


management, and 
SD-LAN 


(ZTP) for CPE devices. 


chassis (VC). 


























A,B, and C class devices supports the following features: 


Authentication for VPNs, firewall, hybrid WAN-dual WAN links 
(active/backup), NAT, security event logs and reporting, single-WAN 
link-managed CPE, user firewall, UTM, and zero-touch provisioning 


D and E class devices supports the following features: 
Automated switch deployment through ZTP, LAN configuration and 


monitoring, Mist Wi-Fi integration, switch management, and virtual 


For more information on device categories, see Table 13 on page 16. 
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Table 12: CSO SKUs for Standard and Advanced License Model (continued) 


License 
Model 


Advanced 
license 


Use Case Examples or 
Solutions 


Hybrid WAN, 
next-generation firewall 
management, and 
SD-WAN 


Features Supported 


A,B, and C class devices supports the following features: 


APBR, AppQoE, Authentication for VPNs, AWS cloud endpoint, 
bandwidth-optimized SLA (RPM), dual CPE, firewall, full mesh or 
dynamic VPN, hub multihoming, hybrid WAN-dual WAN links 
(active/backup), Internet Zscaler breakout, NAT, network segmentation, 
real-time-optimized SLA (AppQoE), SD-WAN up to four WAN links 
(active/active), security event logs and reporting, single-WAN 
link-managed CPE, SLA-based dynamic path selection, user firewall, 
UTM, and zero-touch provisioning (ZTP) for CPE devices 


For more information on device categories, see Table 13 on page 16. 


CSO supports various Juniper Networks devices. Table 13 on page 16 lists the supported devices categorized 


into device classes. 


Table 13: CSO supported Device Classification 


Device Class 


A 


Supported Devices 


SD-WAN Supported Devices Next-Generation Firewall 


e CPE/Spoke (<250) 


Next-Generation Firewall Devices 


SRX300 line of devices with Junos Software Enhanced 


(JSE) 
NFX150 
vSRX (2 vCPUs) 


e CPE/Spoke (<1Gbps) 


e Next-Generation Firewall servies 
with Junos Software Enhanced 
(JSE) 


SRX300 line of devices 
vSRX (2 vCPUs) 


Next-Generation Firewall Devices 


ee) e Next-Generation Firewall servies 
SRX550 with Junos Software Enhanced (JSE) with Junos Software Enhanced 
vSRX (5 vCPUs) (JSE) 

e Enterprise Hub Devices (Gateway) (<1Gbps) vSRX (5 vCPUs) 


SRX1500 (CSO release 5.0x onwards) 


Services gateways with Junos Software Enhanced (JSE) 


e Cloud Hub Devices (<1Gbps) 


SRX1500 


Services gateways with Junos Software Enhanced (JSE) 
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Table 13: CSO supported Device Classification (continued) 


Device Class Supported Devices 


Cc e Enterprise Hub Devices (Gateway) (>1Gbps) Next-Generation Firewall Devices 
se TOt and SRAA2O0 e Next-Generation Firewall servies 
Services gateways with Junos Software Enhanced (JSE) with Junos Software Enhanced 

e Cloud Hub Devices (>1Gbps) (JSE) 
Services gateways with Junos Software Enhanced (JSE) vSRX (7 or 19 vCPUs) 
SRX4100 and SRX4200 
MX80, MX104, MX240, MX480, and MX960 


vSRX (7 or 19 vCPUs) 
D Class D does not support any SD-WAN devices SD-LAN Devices 


e EX2300, EX3400, and EX4300 
switches 


E Class E does not support any SD-WAN devices SD-LAN Devices 


e EX4600 and EX4650 switches 


cSRX 


Table 14 on page 18 shows cSRX features for Flex Software Subscription Model. 


Figure 7 on page 18 shows cSRX features for the Three-Tier (standard, advanced, and premium licenses). 


Figure 7: cSRX 


Premium Software License 


{(Tates U(e [=xomei0 t=) Co)nat-lm-0]e) ole) a9) 


Advanced Software License 


{(Tates 0 (0 [=xom e101) Co)nnt-1mciele) ole) a9) 


Standard 
Software 
License 


Customer 
Support 


Table 14: cSRX Flex Software Subscription Model 


cSRX License 
Model 


Standard 











Premium 1: Use for data center 
security + ATP Cloud 


Includes standard features + 
Application Security, ATP Cloud, 
and IPS 


Advanced 1: Use for data 
center security 


Includes standard features + 
Application Security, and IPS 


Premium 2: Use for next-generation 
firewall + ATP Cloud 


Includes standard features + 
Application Security, ATP Cloud, 
cloud-based antivirus, IPS, and 
URL filtering 


Advanced 2: Use for next-generation 
firewall with cloud-based antivirus 


Includes standard features + 
Application Security, cloud-based 
antivirus, IPS, and URL filtering 


Standard: Use for standard firewall and secure branch routers 
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Premium 3: Use for data center 
security + ATP Cloud 


Includes standard features + 
Application Security, ATP Cloud, 
IPS, on-box antivirus, and 

URL filtering 


Advanced 3: Use for next-generation 
firewall with on-box antivirus 


Includes standard features + 
Application Security, IPS, on-box 
antivirus, and URL filtering 


Standard firewall (routing, firewall, switching, NAT, VPN, and MPLS) and secure branch routers 


cSRX SKUs 


S-CSRX-STD-1 


S-CSRX-STD-3 


S-CSRX-STD-5 








or Solutions 











Use Case Examples 


Use for standard 
firewall and secure 
branch routers 


UES) Sa @7.NS) a SUBSCRIPTION 
FEATURES PERPETUAL 


g301011 


Detailed Features 


Standard firewall 
(routing, firewall, 
switching, NAT, VPN, 
and MPLS) and 
secure branch routers 














Table 14: cSRX Flex Software Subscription Model (continued) 


cSRX License 
Model 


Advanced 


cSRX SKUs 


S-CSRX-A1-1 


S-CSRX-A1-3 


S-CSRX-A1-5 


S-CSRX-A2-1 


S-CSRX-A2-3 


S-CSRX-A2-5 


S-CSRX-A3-1 


S-CSRX-A3-3 


S-CSRX-A3-5 


Use Case Examples 
or Solutions 


Advanced 1 


Use for data center 


security 


Advanced 2 


Use for 
next-generation 
firewall with cloud 
based antivirus 


Advanced 3 


Use for 
next-generation 
firewall with on-box 
antivirus 


Detailed Features 


Advanced 1 


Includes standard 
features + 
Application Security, 
and IPS 


Advanced 2 


Includes standard 
features + 
Application Security, 
cloud-based antivirus, 
IPS, and URL filtering 


Advanced 3 


Includes standard 
features + 
Application Security, 
IPS, on-box antivirus, 
and URL filtering 
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Table 14: cSRX Flex Software Subscription Model (continued) 


cSRX License 


Model cSRX SKUs 


Premium S-CSRX-P1-1 
S-CSRX-P1-3 


S-CSRX-P1-5 


S-CSRX-P2-1 
S-CSRX-P2-3 


S-CSRX-P2-5 


S-CSRX-P3-1 
S-CSRX-P3-3 


S-CSRX-P3-5 


EX2300, EX3400, and EX4300 


Use Case Examples 
or Solutions 


Premium 1 


Use for data center 
security + ATP Cloud 


Premium 2 


Use for 
next-generation 
firewall + ATP Cloud 


Premium 3 


Use for data center 
security + ATP Cloud 


Detailed Features 


Premium 1 


Includes standard 
features + 
Application Security, 
ATP Cloud, and IPS 


Premium 2 


Includes standard 
features + 
Application Security, 
ATP Cloud, 
cloud-based antivirus, 
IPS, and URL filtering. 


Premium 3 


Includes standard 
features + 
Application Security, 
ATP Cloud, IPS, 
on-box antivirus, and 
URL filtering 


Table 15 on page 20 describes the perpetual licensing on the EX2300, EX3400, and EX4300. 


Table 15: Supported Features on EX2300, EX3400, and EX4300 


License Model 


Standard 


Use Case Examples or Solutions 


Campus Access Basic Layer 2/Layer 3 


e 


Detailed Features 
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Filters (Layer 2¢Layer 3), Juniper 1 
and LAG), Layer 2/Layer 3 QnS, 


Virtual Chassis* 


Table 15: Supported Features on EX2300, EX3400, and EX4300 (continued) 


License Model 


Advanced 


Premium 


Use Case Examples or Solutions 


Campus Access Enhanced Layer 2/Layer 3 


Campus Access Advanced Layer 3 


*For EX2300, the Virtual Chassis feature is not included in standard license. 
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e Ss 
Detailed Features 


BFD, filter-basd forwardirig (FE 
Discovery Protocol (MSDP), OA 
RPM, VRF, ani VRRP 


Pp - 3 


With the prenflum license You c 
MBGP, IS-IS, and EVPN-VXLAN 
P - 3 


The perpetual licenses are not portable. In a Virtual Chassis deployment, each Virtual Chassis member 


requires a perpetual feature license. 


MACsec feature requires a standalone perpetual license. 


Table 16 on page 21 describes classification of EX2300, EX3400, and EX4300 switch device class and 


SKUs. 


Table 16: EX2300, EX3400, and EX4300 switch device class and SKUs 


EX Series 
Product Class EX Device Models 


Class 1 EX2300-C-12P 
EX2300-C-12P-TAA 
EX2300-C-12P-VC 
EX2300-C-12T 
EX2300-C-12T-TAA 
EX2300-C-12T-VC 


SKUs 


S-EX-A-C1-P 
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Table 16: EX2300, EX3400, and EX4300 switch device class and SKUs (continued) 


EX Series 
Product Class EX Device Models SKUs 


Class 2 EX2300-24MP S-EX-A-C2-P 

EX2300-24P 

EX2300-24P-TAA 

EX2300-24P-VC 

EX2300-24T 

EX2300-24T-DC 

EX2300-24T-TAA 

EX2300-24T-VC 


EX3400-24P S-EX-A-C2-P 
EX3400-24P-TAA S-EX-P-C2-P 
EX3400-24T 

EX3400-24T-DC 

EX3400-24T-TAA 

EX4300-24P 

EX4300-24T 


Class 3 EX2300-48MP S-EX-A-C3-P 
EX2300-48P 
EX2300-48P-TAA 
EX2300-48P-VC 
EX2300-48T 
EX2300-48T-TAA 
EX2300-48T-VC 


EX3400-48P S-EX-A-C3-P 
EX3400-48P-TAA S-EX-P-C3-P 
EX3400-48T 


EX3400-48T-AFI 
EX3400-48T-AFI-TAA 
EX3400-48T-TAA 
EX4300-32F 
EX4300-48MP 
EX4300-48P 
EX4300-48T-AFI 
EX4300-48T-DC 
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JATP400, JATP700, and ATP Virtual Appliance 


Table 17 on page 23 describes the standard and advance license model support with use case examples 
for the JATP400, JATP700, and ATP Virtual Appliance. 


Table 17: Supported Features on the JATP400, JATP700, and ATP Virtual Appliance 


Use Case Examples or 


License Model Solutions Detailed Features Bandwidth 
Standard 1 ATP on-premises with ATP Core | Malware analysis, SecIntel, Avira 100 Mbps 
and SRX as the collector antivirus 500 Mbps 
1 Gbps 
Standard 2 ATP on-premises with ATP Core | Malware analysis, SecIntel, McAfee 5 Gbps 
and SRX as the collector antivirus 10 Gbps 
Advanced 1 ATP on-premises with third-party | Standard 1 plus Threat Analytics and Moats 
integrations. ATP Core with SRX | mitigation with third-party products ili a 
‘ stackable. 
plus ATP collectors, analytics, and 
mitigations 
Advanced 2 ATP on-premises with third-party | Standard 2 plus Threat Analytics and 


integrations. ATP Core with SRX | mitigation with third-party products 
plus ATP collectors, Analytics, 
and mitigations 


MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and MX204 Routers 


Table 18 on page 24 describes the licensing support with use case examples for the MPC10E, 
MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 line cards and MX204 routers. 


MPC10E-10C and MPC10E-15C line cards are supported on MX240, MX480, and MX960 devices 
MX2K-MPC11E line cards are supported on MX2010 and MX2020 devices 

MX10K3-L2103 line card is supported on MX10003 device 

MX10K-LC2101 line cards are supported on MX10008 and MX10016 devices 


Figure 8 on page 24 shows MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and 
MX204 Routers features for the Three-Tier (standard, advanced, and premium licenses). 


Figure 8: MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and MX204 Routers 


Premium: Services 


Includes advanced features SCALE: 
High scale IP-VPNs 32+ IP VPNs 


Premium Software License 


IP fabrics (SRv6 and SRm6) 8+ multicast VPNs 
PWHT for Layer 3 VPNs or BNG 

Inline NAT and inline MDI 

1:1 inline J-Flow 


(includes customer support) 








Advanced: Transport 


IP routing, IGP (OSFP and IS-IS), IP-FRR, PIM variants, and IGMP SCALE: 
Internet eBGP peering, BGP multihoming (add path and multi-path), EPE, and BGP PIC 32 IP VPNs — all 
BGP Flow specification address families 
All Layer 2 services—E-LINE (Layer 2 VPNs, Layer 2 ckt, EVPN VPWS, EVPN FXC), 

E-LAN (bridging, H-VPLS, EVPN, and IRB), E-TREE (H-VPLS, EVPN, and IRB), Layer 2 8 next-generation 
multicast (snooping included) MVPN 

All MPLS transport—LDP, RSVP-TE, SR, SR-TE, and MPLS-FRR (including TI-LFA) 

IP fabrics (GRE, MPLSoUDP, VxLAN, and IPinIP) 

Streaming telemetry and SNMP 

Policers, ACLs, J-Flow (sampled), sFLow, port mirroring, and per VLAN queuing 

Timing (all variants) 

OAM—BFD, Ethernet CFM or LFM, MPLS or SR (ping and traceroute), services 

OAM, RPM, and TWAMP 


Advanced Software License 


(includes customer support) 








Standard 
Software 
License 


Standard: Basic Layer 2 features 


Bridging with port and single level VLAN (dot1Q), and LAG SCALE: 
Not Applicable 


Hardware 





USE CASE SUBSCRIPTION 
FEATURES PERPETUAL 


9301053 


Table 18: Supported Features on MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards 


and MX204 Routers 


Use Case Examples 
License Model or Solutions Feature Buckets Scale 


| 
Standard Basic Layer 2 | Bridging with port and single level VLAN Not Applicable 
features | (dot1Q), and LAG 
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Table 18: Supported Features on MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards 
and MX204 Routers (continued) 


License Model 


Advanced 


Premium 


Use Case Examples 
or Solutions 


Transport 


Services 


Feature Buckets 


IP routing, IGP (OSFP and IS-IS), IP-FRR, 
PIM variants, and IGMP 

Internet eBGP peering, BGP multihoming 
(add path and multi-path), EPE, and BGP 
PIC 

BGP Flow specification 

All Layer 2 services—E-LINE (Layer 2 VPNs, 
Layer 2 ckt, EVPN VPWS, EVPN FXC), 
E-LAN (bridging, H-VPLS, EVPN, and IRB), 
E-TREE (H-VPLS, EVPN, and IRB), Layer 2 
multicast (snooping included) 

All MPLS transport—LDP, RSVP-TE, SR, 
SR-TE, and MPLS-FRR (including TI-LFA) 
IP fabrics (GRE, MPLSOUDP, VxLAN, and 
IPinIP) 


Streaming telemetry and SNMP 

Policers, ACLs, J-Flow (sampled), sFLow, 
port mirroring, and per VLAN queuing 
Timing (all variants) 

OAM-—BFD, Ethernet CFM or LFM, MPLS 


or SR (ping and traceroute), services OAM, 
RPM, and TWAMP 


The Junos Fusion Technology feature requires 


an additional license in addition to Advanced 


license. 


Includes advanced features 

High scale IP-VPNs 

IP fabrics (SRv6 and SRmé) 
PWHT for Layer 3 VPNs or BNG 
Inline NAT and inline MDI 


1:1 inline J-Flow 


The subscriber management (BNG or CUPS) 
feature requires an additional license in 


addition to Premium license. 


Scale 


32 IP VPNs - all 
address families 


8 next-generation 
MVPN 


32+ IP VPNs 


8+ multicast VPNs 
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Licensing tiers for Flex Software Subscription Model are based on large functional blocks. Features that 


are not explicitly listed in Premium license are included in Advanced license, except for the following: 


e Junos Fusion Technology requires additional license in addition to Advanced or Premium license. 


e Premium software tier is a prerequisite for running subscriber services (BNG(PL), BNG CUPS, MX Mobile 
User Plane (SAEGW-U, 5G AGF or UPF)). 


Table 19 on page 26 describes SKUs for MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 


Line Cards and MX204 Routers. 


Table 19: MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and MX204 Routers 


SKUs 


Product Model 


MX204 


MX204 


MX10K3-L2103 


Supported on MX10003 device 


MX10K3-L2103 


Supported on MX10003 device 


MX10K-LC2101 


Supported on MX10008 and MX10016 
devices 


MX10K-LC2101 


Supported on MX10008 and MX10016 
devices 


License Model 


Subscription 


Perpetual 


Subscription 


Perpetual 


Subscription 


Perpetual 


SKUs 


MX204-HW-BASE 


S-MX-4C-A1-C1-3/5/1* 


S-MX-4C-P1-C1-3/5/1* 


MX204-HW-BASE 


S-MX-4C-A1-C1-P 


S-MX-4C-P1-C1-P 


MX10K3-L2103-BASE 


S-MX-12C-A1-C1-3/5/1* 


S-MX-12C-P1-C1-3/5/1* 


MX10K3-L2103-BASE 


S-MX-12C-A1-C1-P 


S-MX-12C-P1-C1-P 


MX10K-LC2101-BASE 


S-MX-24C-A1-3/5/1* 


S-MX-24C-P1-3/5/1* 


MX10K-LC2101-BASE 


S-MX-24C-A1-P 


S-MX-24C-P1-P 


Table 19: MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and MX204 Routers 


SKUs (continued) 


Product Model 


MX2K-MPC11E 


Supported on MX2010 and MX2020 devices 


MX2K-MPC11E 


Supported on MX2010 and MX2020 devices 


MPC10E-10C 


Supported on MX240, MX480, and MX960 
devices 


MPC10E-10C 


Supported on MX240, MX480, and MX960 
devices 


MPC10E-15C 


Supported on MX240, MX480, and MX960 
devices 


MPC10E-15C 


Supported on MX240, MX480, and MX960 
devices 


License Model 


Subscription 


Perpetual 


Subscription 


Perpetual 


Subscription 


Perpetual 


*41 year subscription term is for renewal only. 


MX-SPC3 Services Card 


Table 20 on page 28 describes the licensing support with use case examples for the MX-SPC3 services 


card. 


SKUs 


MX2K-MPC11E-BASE 


S-MX-40C-A1-3/5/1* 


S-MX-40C-P1-3/5/1* 


MX2K-MPC11E-BASE 


S-MX-40C-A1-P 


S-MX-40C-P1-P 


MPC10E-10C-P-BASE 


S-MX-10C-A1-3/5/1* 


S-MX-10C-P1-3/5/1* 


MPC10E-10C-P-BASE 


S-MX-10C-A1-P 


S-MX-10C-P1-P 


MPC10E-15C-P-BASE 


S-MX-15C-A1-3/5/1* 


S-MX-15C-P1-3/5/1* 


MPC10E-15C-P-BASE 


S-MX-15C-A1-P 


S-MX-15C-P1-P 
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Figure 9 on page 28 shows MX-SPC3 services card features for the Three-Tier (standard, advanced, and 


premium licenses). 


Figure 9: MX-SPC3 Services Card 


Premium Software License 


((Tates[b(e [=tome0 l=) Co)ant-Vmr-i0] 0) ole) a9) 


Advanced Software License 


((Tates[0(e [=X el0 F<) Coyant=Van-0 0) ole) 49) 


Standard 
Software License 


Customer 
|? | Support 


Hardware 


Premium 1: Enterprise data center 


and edge; service provider edge 


CGN, DNS sinkhole, IDS, 


stateful firewall, and URL filtering 


Advanced 1: Enterprise data center} 


and edge; service provider edge 


Carrier-grade NAT (CGNAT) 


Premium 2: Service provider edge; 
Gi firewall for mobile operators; 
enterprise edge and data center 


CGN, DNS sinkhole, IDS, 
stateful firewall, and URL filtering 


Advanced 2: Service provider edge} 


(CT ilc-\i F-Umcolm tile) e)|(-me)el-1e-1 eee 
enterprise edge and data center 


Stateful firewall 


Standard: Enterprise data center; service provider edge and data center 


Traffic Load Balancer (TLB) 





Premium 3: Advanced threat 
intelligence 


DNS sinkhole, IDS, and 
URL filtering 


Advanced 3: Advanced threat 
Halli ite] =aver=) 


Intrusion detection system (IDS) 


USS) Sey No) = SUBSCRIPTION 


FEATURES PERPETUAL 


Table 20: Supported Features on MX-SPC3 Services Card 


Standard Enterprise data 


Advanced 1 Enterprise data 


_ Use Case Examples 
License Model or Solutions 


center; service 
provider edge and 
data center 


center and edge; 
service provider edge 


Detailed Features 


Traffic Load Balancer (TLB) 


Carrier-grade NAT (CGNAT) 


301141 


License SKUs 


MX-SPC3 


| S-MXSPC3-A1-1/3/5 


S-MXSPC3-A1-P 





Advanced 2 Service provider 























edge; Gi firewall for 
mobile operators; 
enterprise edge and 
data center 




















Stateful firewall 


| S-MXSPC3-A2-1/3/5 


S-MXSPC3-A2-P 
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Table 20: Supported Features on MX-SPC3 Services Card (continued) 


Use Case Examples 


License Model or Solutions Detailed Features License SKUs 
Advanced 3 Advanced threat Intrusion detection system (IDS) S-MXSPC3-A3-1/3/5 
intelligence 


S-MXSPC3-A3-P 


Premium 1 Enterprise data CGN, DNS sinkhole, IDS, stateful firewall, and § S-MXSPC3-P1-1/3/5 
center and edge; URL filtering 


: ' S-MXSPC3-P1-P 
service provider edge 


Premium 2 Service provider CGN, DNS sinkhole, IDS, stateful firewall, and § S-MXSPC3-P2-1/3/5 
edge; Gi firewall for | URL filtering 


: S-MXSPC3-P2-P 
mobile operators; 


enterprise edge and 
data center 


Premium 3 Advanced threat DNS sinkhole, IDS, and URL filtering S-MXSPC3-P3-1/3/5 


intelligence 
S-MXSPC3-P3-P 


NFX350 


Table 21 on page 30 shows NFX350 features for Flex Software Subscription Model. 


Figure 10 on page 30 shows NFX350 features for the Three-Tier (standard, advanced, and premium 
licenses). 


Figure 10: NFX350 


Premium 1: Use for data center 
security or SD-WAN + ATP Cloud 


Premium Software License 


(includes customer support) 
Includes IPS, Application Security, 
and ATP Cloud 


Advanced 1: Use for data center 
security + SD-WAN 


Advanced Software License 


(includes customer support) 
Includes IPS and 
Application Security 


Site larel-tee| 
Software 
License 


Hardware 


Customer 
Support 


Table 21: NFX350 Flex Software Subscription Model 


Premium 2: Use for next- 
generation firewall + ATP Cloud 


Includes IPS, Application Security, 
URL filtering, Sophos antivirus 
and antispam, and ATP Cloud 


Advanced 2: Use for next- 
generation firewall with Sophos 


Includes IPS, Application Security, 
URL filtering, Sophos antivirus 
and antispam 
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Premium 3: Use for data center 
security or SD-WAN + ATP Cloud 


Includes IPS, Application Security, 
URL filtering, On-box antivirus, 
and ATP Cloud 


Advanced 3: Use for next- 
generation firewall with Avira 


Includes IPS, Application Security, 
URL filtering, On-box antivirus 


Standard: Use for basic firewall and secure branch routers 


Includes hardware, plus Junos Base JSB (routing, firewall, switching, NAT, VPN, and MPLS) 


USS) Sa O7 NS) = SUBSCRIPTION 
FEATURES PERPETUAL 





Oo 
5 
8 
8 
2) 




















NFX350 

License 

Model Use Case Examples or Solutions Detailed Features 

Standard Use for basic firewall and secure branch Includes hardware, plus Junos Base JSB (routing, 
routers firewall, switching, NAT, VPN, and MPLS) 

Advanced Advanced 1 Advanced 1 


Use for data center security + SD-WAN 


Includes IPS and Application Security 

















Advanced 2 


Use for next-generation firewall with Sophos 


Advanced 2 


Includes IPS, Application Security, URL filtering, 
Sophos antivirus and antipsam 











Advanced 3 


Use for next-generation firewall with Avira 





Advanced 3 


Includes IPS, Application Security, URL filtering, 
On-box antivirus 
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Table 21: NFX350 Flex Software Subscription Model (continued) 


NFX350 

License 

Model Use Case Examples or Solutions 

Premium Premium 1 
Use for data center security or SD-WAN + 
Cloud ATP 
Premium 2 
Use for next-generation firewall + Cloud ATP 
Premium 3 
Use for data center security or SD-WAN + 
Cloud ATP 

PTX10003 


Detailed Features 


Premium 1 


Includes IPS, Application Security, and ATP Cloud 


Premium 2 


Includes IPS, Application Security, URL filtering, 
Sophos antivirus and antispam, and ATP Cloud 


Premium 3 


Includes IPS, Application Security, URL filtering, 
On-box antivirus, and ATP Cloud 


Table 22 on page 32 describes the licensing support for the PTX10003. 


Figure 11 on page 32 shows PTX10003 features for the Three-Tier (standard, advanced, and premium 


licenses). 


32 


Figure 11: PTX10003 


Premium 1 and 2 Features License 


With the premium license, you can use all the software features that are supported on PTX10003. 


Advanced 2 Features License 


Licenses ul Customer Advanced 1 features, EVPN-MPLS, Layer 2 circuit, Layer 3 VPN, LDP, RSVP, segment routing, and 


Support segment routing traffic engineering (SR-TE) 


Advanced 1 Features License 


BGP, connectivity fault management (CFM), EVPN-VXLAN, filter-based forwarding (FBF), filter- 
based generic routing encapsulation (GRE), IS-IS, Juniper telemetry interface (JTI), Layer 3 multicast, 
MACsec, OAM, OSPF, PTP, Q-in-Q, VRF, and VRRP 










Base 
Feature Filters (Layer 2 and Layer 3), Layer 2 (xSTP, 802.1Q, LAG), 
Software Layer 3 (static), quality of service or QoS (Layer 2 and Layer 3), and SNMP. 


re Customer 
Support 


PTX10003 
Router 


PTX10003 Router (Perpetual Purchase) 





g300668 


Table 22: Supported Features on PTX10003 


Detailed Features for 


PTX10003 License Use Case Examples or | 

Model _ Solutions _ Fabric Management Scale 

Standard Basic Layer 2 switching or | Filters (Layer 2 and Layer 64K FIBs 
basic Layer 3 routing 3), Layer 2 (xSTP, 802.1Q, 


LAG), Layer 3 (static), | 
quality of service or QoS 
(Layer 2 and Layer 3), and 
SNMP 








Table 22: Supported Features on PTX10003 (continued) 


PTX10003 License 
Model 


Use Case Examples or 
Solutions 
Advanced Advanced 1 


Data center IP spine (cloud 
and enterprise segment) 


Advanced 2 
Data center interconnect 


and data center or WAN 
edge 


Premium Premium 1 


Label switch routing (LSR) 
and peering 


Premium 2 


High-scale LSR, IP core, and 
peering 


Detailed Features for 
Fabric Management 


BGP, connectivity fault 
management (CFM), 
EVPN-VXLAN, filter-based 
forwarding (FBF), 
filter-based generic routing 
encapsulation (GRE), IS-IS, 
Juniper telemetry interface 
(JTI), Layer 3 multicast, 
MACsec, OAM, OSPF, PTP, 
Q-in-Q, VRF, and VRRP 


Advanced 1 features, 
EVPN-MPLS, Layer 2 
circuit, Layer 3 VPN, LDP, 
RSVP, segment routing, and 
segment routing traffic 
engineering (SR-TE) 


With the premium license, 
you can use all the software 
features that are supported 
on PTX10003. 


With the premium license, 
you can use all the software 
features that are supported 
on PTX10003. 
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Scale 


256K FIBs, 3M RIBs, and 
256 VRFs 


1M FIBs, 3M RIBs, 1K LSPs, 
and 1K VRFs 


2M FIBs, 6M RIBs, 32K 
LSPs, and 1K VRFs 


2M to 4M FIBs, 60M to 80 
M RIBs, 100K+ LSPs, and 
1K to 2K VRFs 


For PTX10003, the Flex Software Subscription Model supports subscription portability for the cloud, 


enterprise, and service provider segments. 


PTX10008 


34 


Table 23 on page 35 describes the licensing support for the PTX10008 Packet Transport Router. 


Figure 12 on page 34 shows PTX10008 features for the Three-Tier (standard, advanced, and premium 


licenses). 


Figure 12: PTX10008 


Premium Software License 


(Tales U(e [=t-mei0 l=) Colnnl-varc10] 0) ele) aa) 


Advanced Software License 


(includes customer support) 


Site late l-tce| 
Software 
License 


Hardware 


Customer 
Support 


Premium 1: Label-switching router (LSR) and peering 


With the premium license, you can use 
all software features that are supported 
on the PTX10008. 


Advanced 1: Data center IP spine 


BGP, connectivity fault management (CFM), 
EVPN, EVPN-VXLAN, fine-grained CoS, filter: 
based forwarding (FBF), filter-based generic 
routing encapsulation (GRE), IS-IS, Junos 
telemetry interface (JTI), Layer 3 multicast, 
MC-LAG, MPLS forwarding, OAM, OSPF, 
PTP-TC, Q-in-Q, sFlow, VRF, and VRRP 


SCALE: 
2M FIBs, 

6M RIBs, 
32K LSPs, 
and 1K VRFs 


SCALE: 
256K FIBs, 
3M RIBs, 

and 256 VRFs 


Standard: Basic Layer 2 switching or basic Layer 3 routing 


Premium 2: High-scale LSR, IP core, and peering 


With the premium license, you can use 
all software features that are supported 


on the PTX10008. 


Advanced 2: Data center interconnect and 


data center or WAN edge 


Advanced 1 features, EVPN-MPLS, 


Layer 2 circuit, Layer 3 VPN, LDP, RSVP, 
segment routing, and segment routing 


traffic engineering (SR-TE) 


Filters (Layer 2 and Layer 3), Layer 2 (xSTP, 802.1Q, LAG), Layer 3 (static), 
quality of service or QoS (Layer 2 and Layer 3), and SNMP 





SCALE: 

2M to 4M FIBs, 
60M to 80M RIBs, 
100K+ LSPs, and 
1K to 2K VRFs 


SCALE: 

1M FIBs, 

3M RIBs, 

1K LSPs, 
and 1K VRFs 


SCALE: 
64K FIBs 


USE CASE SUBSCRIPTION [i 
FEATURES PERPETUAL A 


Table 23: Supported Features on PTX10008 


PTX10008 
License 
Model 


Standard 


Advanced 


Premium 


Use Case Examples 
or Solutions 


Basic Layer 2 switching 
or basic Layer 3 routing 


Advanced 1 


Data center IP spine 


Advanced 2 
Data center 


interconnect and data 
center or WAN edge 


Premium 1 


Label-switching router 
(LSR) and peering 


Detailed Features for 
Fabric Management 


Filters (Layer 2 and 
Layer 3), Layer 2 (xSTP, 
802.1Q, LAG), Layer 3 
(static), quality of 
service or QoS (Layer 2 
and Layer 3), and 
SNMP 


BGP, connectivity fault 
management (CFM), 
EVPN, EVPN-VXLAN, 
fine-grained CoS, 
filter-based forwarding 
(FBF), filter-based 
generic routing 
encapsulation (GRE), 
IS-IS, Junos telemetry 
interface (JTI), Layer 3 
multicast, MC-LAG, 
MPLS forwarding, 
OAM, OSPF, PTP-TC, 
Q-in-Q, sFlow, VRF, 
and VRRP 


Advanced 1 features, 
EVPN-MPLS, Layer 2 
circuit, Layer 3 VPN, 
LDP, PTP-BC, RSVP, 
segment routing, and 
segment routing-traffic 
engineering (SR-TE) 


Scale 


64K FIBs 


256K FIBs, 3M RIBs, 
and 256 VRFs 


1M FIBs, 3M RIBs, 1K 


LSPs, and 1K VRFs 


2M FIBs, 6M RIBs, 32K 
LSPs, and 1K VRFs 
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Security License 


The PTX10008 router 
supports the MACsec 
feature, but you must 
purchase a license 
separately to use the 
feature. 


36 


Table 23: Supported Features on PTX10008 (continued) 


PTX10008 
License Use Case Examples 
Model or Solutions 


Premium 2 


High-scale LSR, IP core, 
and peering 


Detailed Features for 
Fabric Management Scale Security License 


With the premium 
license, you can use all 
software features that 
are supported on the 
PTX10008. 


With the premium 2M to 4M FIBs, 60M to 
license, you can use all 80MRIBs, 100K+ LSPs, 
software features that and 1K to 2K VRFs 
are supported on the 

PTX10008. 


For PTX10008, the Flex Software Subscription Model supports subscription portability for the cloud, 
enterprise, and service provider segments. 


For feature support on the PTX10008, see Feature Explorer or contact customer support. 


The PTX10008 supports MACsec, but you must purchase a license to use the MACsec feature. MACsec 
licenses are perpetual. The licenses are available in two variants, which are described in Table 24 on page 36, 


Table 24: MACsec Feature License SKUs 


MACsec License SKU 


S-PTX10K100GMSEC-P 


S-PTX10K400GMSEC-P 


Description 


100-Gigabit Ethernet MACsec license; can be applied to one 100-Gigabit 
Ethernet port or two 40-Gigabit Ethernet ports 


400-Gigabit Ethernet MACsec license; can be applied to one 400-Gigabit 
Ethernet port or four 100-Gigabit Ethernet ports 


Table 25 on page 36 describes SKUs for the PTX10000 14.4-Tbps line card. 


Table 25: PTX10000 14.4-Tbps Line-Card License SKUs 


Line Card 


PTX10000 14.4-Tbps line card 


License Model SKU 


Perpetual PTX10K-LC1201-36CD 
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Table 25: PTX10000 14.4-Tbps Line-Card License SKUs (continued) 


Line Card License Model SKU 


PTX10000 14.4-Tbps line card licenses without | Perpetual S-PTX10K-144C-A1/A2-P 


customer support 
S-PTX10K-144C-P1/P2-P 


PTX10000 14.4-Tbps line card licenses with Subscription S-PTX10K-144C-A1/A2-3/5 


customer support 
S-PTX10K-144C-P1/P2-3/5 


Table 26 on page 37 describes partner SKUs for the PTX10000 14.4-Tbps line card. 
Table 26: PTX10000 14.4-Tbps Line-Card Partner License SKUs 


Line Card License Model SKU 


PTX10000 14.4-Tbps line card Subscription S-PARPTX10K144CA13 

licenses with customer support 
S-PARPTX10K144CA23 
S-PARPTX10K144CA15 
S-PARPTX10K144CA25 
S-PARPTX10K144CP13 
S-PARPTX10K144CP15 
S-PARPTX10K144CP23 


S-PARPTX10K144CP25 


Table 27 on page 38 defines the parts of a PTX10000 SKU definition. 


Table 27: PTX10000 SKU Definition 


SKU 


S-PTX10K-144C-A1/A2/P1/P2-P 
S-PTX10K-144C-A1/A2/P1/P2-3/5 


S-PARPTX10K144CA1/A2/P1/P2/3/5 


QFX Switches 
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SKU Character Description 


S—Software 

PTX10K—Product name: PTX10000 line of routers 
144C—14.4 Tbps 

PAR—Partner 

A1/A2—Advanced 1 or advanced 2 software features 
P1/P2—Premium 1 or premium 2 software features 


3/5—Subscription term 3 or 5 years 


QFX switch models that support the Software Subscription Model: 


e QFX5110-48S 
e QFX5110-32Q 
e QFX5120-48Y 
e QFX5120-48T 
e QFX5120-32C 
e QFX5200-32C 
e QFX5210-64C 
e QFX5220-32CD 
e QFX5220-128C 


QFX5110-48S, QFX5110-32Q, QFX5200-32C, QFX5210-64C, and QFX5120-48Y support non-Flex 
Software Subscription Models and Flex Software Subscription Model. For example, the QFX5120-48Y 
supports QFX5120-48Y-AFO and QFX5120-48Y-AFO2, respectively. 


Figure 13 on page 39 shows QFX switch features for the Three-Tier (standard, advanced, and premium 


licenses). 
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Figure 13: QFX Switch 


Premium Features 


Advanced Enterprise Features (i@eNZlalelfeK-inl cli olitst Micrel cic 
EVPN-MPLS, Layer 2 circuit, 
Advanced Cloud Features BGP, CFM, EVPN-VXLAN, FBF, Layer 3 VPN, LDP, RSVP, 
GRE, IS-IS, JTI, Layer 3 multicast Segment routing, and SR-TE. 
MC-LAG, VRRP, OSPF, MC-LAG, OAM, OSPF, PTP, 
IS-IS, BGP, VRF, FBF, GRE, Q-in-Q, Virtual Chassis, VRF 
and JTI. and VRRP. 


Customer 


if a 
icenses re | Support 








Base Feature 
Software 


2 Customer 
|? | Support 


QFX Series 


Filters (Layer 2 and Layer 3), Layer 2 (xSTP, 802.10, LAG), 
Layer 3 (static), QoS (Layer 2 and Layer 3), and SNMP 


Hardware 





QFX Series Hardware (Perpetual Purchase) 


Perpetual Only 
Subscription + Perpetual [i 
Feature Options Mil 


9300378 


Table 28 on page 39 describes the licensing support with use case examples for the QFX5110-48S, 
QFX5110-32Q, QFX5120-48Y, QFX5120-48T, QFX5120-32C, QFX5200-32C, QFX5210-64C, 
QFX5220-32CD, and QFX5220-128C switches. 


Table 28: Supported Features on QFX5110-48S, QFX5110-32Q, QFX5120-48Y, QFX5120-48T, 
QFX5120-32C, QFX5200-32C, QFX5210-64C, QFX5220-32CD, and QFX5220-128C switches 


Use Case Examples or 
QFX Switch License Model Solutions Detailed Features 


Standard license for integrated Basic Layer 2 switching or Filters (Layer 2 and Layer 3), Layer 2 (xSTP, 802.1Q, 
SKUs (standard hardware and basic Layer 3 forwarding LAG), Layer 3 (static), QoS (Layer 2 and Layer 3), 


software platform) and SNMP 
Advanced license for integrated Data center fabric Advanced 1: BGP, FBF, GRE, IS-IS, JT], MC-LAG, 
and advanced SKUs OSPF, VRF and VRRP. 


Advanced 2: BGP, CFM, EVPN-VXLAN, FBF, GRE, 
IS-IS, JTI, Layer 3 multicast, MC-LAG, OAM, OSPF, 
PTP, Q-in-Q, Virtual Chassis, VRF and VRRP. 


Premium license for integrated Data center interconnect or | MPLS: Advance Enterprise Features, EVPN-MPLS, 
and premium SKUs data center edge Layer 2 circuit, Layer 3 VPN, LDP, RSVP, Segment 
routing, and SR-TE. 


Table 29 on page 40 describes classification of QFX switch device class and SKUs. 


Table 29: QFX switch device class and SKUs 


QFX 5000 

Series 

Product 

Class QFX Device Models SKUs 

Class 1 QFX5110-32Q-AFO2 S-QFX5K-C1-A1-3 
QFX5110-32Q-AFI2 S-QFX5K-C1-A1-5 
QFX5110-32Q-D-AFO2 S-QFX5K-C1-A1-P 
QFX5110-32Q-D-AFI2 S-QFX5K-C1-A2-3 
QFX5110-48S-AFO2 S-QFX5K-C1-A2-5 
QFX5110-48S-AFI2 S-QFX5K-C1-A2-P 
QFX5110-48S-D-AFO2 S-QFX5K-C1-P1-3 
QFX5110-48S-D-AFI2 S-QFX5K-C1-P1-5 
QFX5110-48S-AFI-T2 S-QFX5K-C1-P1-P 
QFX5110-48S-AFO-T2 
QFX5120-48Y-AFO2 
QFX5120-48Y-AF12 
QFX5120-48Y-D-AFO2 
QFX5120-48Y-D-AFI2 
QFX5120-48T-AFO 
QFX5120-48T-AFI 
QFX5120-48T-DC-AFO 
QFX5120-48T-DC-AFI 

Class 2 QFX5120-32C-AFO S-QFX5K-C2-A1-3 


QFX5120-32C-AFI 
QFX5120-32C-AFI-T 
QFX5120-32C-AFO-T 
QFX5120-32C-DC-AFO 
QFX5120-32C-DC-AFI 
QFX5200-32C-AFO2 
QFX5200-32C-AF12 
QFX5200-32C-D-AFO2 
QFX5200-32C-D-AFI2 
QFX5200-32C-AFO-T2 
QFX5200-32C-AFI-T2 


S-QFX5K-C2-A1-5 
S-QFX5K-C2-A1-P 
S-QFX5K-C2-A2-3 
S-QFX5K-C2-A2-5 
S-QFX5K-C2-A2-P 
S-QFX5K-C2-P1-3 
S-QFX5K-C2-P1-5 
S-QFX5K-C2-P1-P 


Table 29: QFX switch device class and SKUs (continued) 


QFX 5000 

Series 

Product 

Class QFX Device Models SKUs 

Class 3 QFX5210-64C-AFO2 S-QFX5K-C3-A1-3 
QFX5210-64C-AFI2 S-QFX5K-C3-A1-5 
QFX5210-64C-D-AFO2 S-QFX5K-C3-A1-P 
QFX5210-64C-D-AFI2 S-QFX5K-C3-A2-3 
QFX5210-64C-AFO-T2 S-QFX5K-C3-A2-5 
QFX5210-64C-AFI-T2 S-QFX5K-C3-A2-P 
QFX5220-32CD-AFO S-QFX5K-C3-P1-3 
QFX5220-32CD-AFI S-QFX5K-C3-P1-5 
QFX5220-32CD-D-AFO S-QFX5K-C3-P1-P 


QFX5220-32CD-D-AFI 
QFX5220-128C-AFO 
QFX5220-128C-D-AFO 


SRX Series Services Gateways 


Flex Software Subscription Model supported on SRX300, SRX550M, SRX1500, SRX4100, SRX4200, 
SRX4600, SRX5400, SRX5600, and SRX5800 devices. 


Figure 14 on page 42 shows SRX Series Services Gateways features for Flex Software Subscription Model 
Three-Tier (standard, advanced, and premium licenses). 


Figure 14: SRX Series Services Gateways 


Premium Software License 


(includes customer support) 


Advanced Software License 


(includes customer support) 


Site larel-tee| 
Software 
License 


Customer 
a= Support 


Hardware 


Premium 1: Use for data center 
security or SD-WAN + ATP Cloud 


Includes IPS, Application Security, 
and ATP Cloud 


Advanced 1: Use for data center 
security + SD-WAN 


Includes IPS and 
Application Security 
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Premium 2: Use for next- Premium 3: Use for data center 
generation firewall + ATP Cloud security or SD-WAN + ATP Cloud 


Includes IPS, Application Security, | | Includes IPS, Application Security, 
URL filtering, Sophos antivirus URL filtering, On-box antivirus, 
and antispam, and ATP Cloud and ATP Cloud 


Advanced 2: Use for next- Advanced 3: Use for next- 
generation firewall with Sophos generation firewall with Avira 


Includes IPS, Application Security, 
URL filtering, Sophos antivirus 
and antispam 


Includes IPS, Application Security, 
URL filtering, On-box antivirus 


Standard: Use for basic firewall and secure branch routers 


Includes hardware, plus Junos Base JSB (routing, firewall, switching, NAT, VPN, and MPLS) 
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Table 30 on page 42 shows SRX Series Services Gateways features for Flex Software Subscription Model. 


Table 30: SRX Series Services Gateways Flex Software Subscription Model 


SRX Series 
Services 
Gateways 


License Model Use Case Examples or Solutions 


Standard Use for basic firewall and secure branch 


routers 





Detailed Features 





Includes hardware, plus Junos Base JSB (routing, 
firewall, switching, NAT, VPN, and MPLS) 
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Table 30: SRX Series Services Gateways Flex Software Subscription Model (continued) 


SRX Series 
Services 
Gateways 
License Model 


Advanced 


Premium 


Use Case Examples or Solutions 


Advanced 1 


Use for data center security + SD-WAN 


Advanced 2 


Use for next-generation firewall with Sophos 


Advanced 3 


Use for next-generation firewall with Avira 


Premium 1 


Use for data center security or SD-WAN + 
ATP Cloud 


Premium 2 


Use for next-generation firewall + ATP Cloud 


Premium 3 


Use for data center security or SD-WAN + 
ATP Cloud 


Detailed Features 


Advanced 1 


Includes IPS and Application Security 


Advanced 2 


Includes IPS, Application Security, URL filtering, 
Sophos antivirus and antispam 


Advanced 3 


Includes IPS, Application Security, URL filtering, 
On-box antivirus 


Premium 1 


Includes IPS, Application Security, and ATP Cloud 


Premium 2 


Includes IPS, Application Security, URL filtering, 
Sophos antivirus and antispam, and ATP Cloud 


Premium 3 


Includes IPS, Application Security, URL filtering, 
On-box antivirus, and ATP Cloud 


Advanced 3 and Premium 3 license models are not supported on SRX300, SRX320, SRX340, SRX345, and 


SRX380 devices. 


vSRX 


Table 31 on page 44 shows vSRX features for Flex Software Subscription Model. 


Figure 15 on page 44 shows vSRX features for Flex Software Subscription Model Three-Tier (standard, 


advanced, and premium licenses). 


Figure 15: vSRX 
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(includes customer support) 


Advanced Software License 
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Standard 
Software 
License 


Customer 
Support 


Premium 1: Use for data center 
security and ATP Cloud 


Includes standard and Advanced 1 
features, and ATP Cloud 


Advanced 1: Use for data 
center security 


Includes standard features + IPS and 
Application Security (Application 
Identification, Application Firewall, 
Application Quality of Service, and 
Application Tracking) 


Premium 2: Use for next- Premium 3: Use for next- 
generation firewall and ATP Cloud generation firewall and ATP Cloud 


Includes standard and Advanced 2 Includes standard and Advanced 3 
features, and ATP Cloud features, and ATP Cloud 


Advanced 2: Use for next- PNe NV ales-\e cyan Os<1-8 (0) a= ).4 
generation firewall generation firewall 
with cloud-based antivirus with on-box antivirus 


Includes standard and Advanced 1 Includes standard and 

features, Sophos antivirus, Advanced 1 features, Avira 

Web filtering, Antispam, and antivirus, Web filtering, Antispam, 
content filtering and content filtering 


Standard: Use for standard firewall and secure branch routers 


ALGs, BGP, Class of Service (CoS), DHCP, diagnostics, firewall, GRE, IP tunneling, IPv4 and IPv6, 
Jflow, management (J-Web, CLI, and NetConf), MPLS, multicast, NAT, on-box logging, OSPF, screens, 
site to site VPN, static routing, and user firewall 
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Table 31: vSRX Flex Software Subscription Model 


vSRX 
License 
Model 


Standard 








Use Case Examples or 
Solutions 


Use for standard firewall and 


secure branch routers 


_ Number of 
vCPUs Required Detailed Features 


2,5,9,or17vCPUs | ALGs, BGP, Class of Service (CoS), DHCP, 
diagnostics, firewall, GRE, IP tunneling, IPv4 and 
IPv6, Jflow, management (J-Web, CLI, and 
NetConf), MPLS, multicast, NAT, on-box logging, 
OSPF, screens, site to site VPN, static routing, 
and user firewall 

















Table 31: vSRX Flex Software Subscription Model (continued) 


vSRX 

License Use Case Examples or 

Model Solutions 

Advanced | Advanced 1 
Use for data center security 
Advanced 2 
Use for next-generation firewall 
with cloud based antivirus 
Advanced 3 
Use for next-generation firewall 
with on-box antivirus 

Premium | Premium 1 


Use for data center security and 
ATP Cloud 


Premium 2 


Use for next-generation firewall 
and ATP Cloud 


Premium 3 


Use for next-generation firewall 
and ATP Cloud 


Number of 
vCPUs Required 


2,5,9, or 17 vCPUs 


2,5,9, or 17 vCPUs 


5,9, or 17 vCPUs 


2,5,9, or 17 vCPUs 


2,5,9, or 17 vVCPUs 


5,9, or 17 vCPUs 
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Detailed Features 


Advanced 1 


Includes standard features + IPS and Application 
Security (Application Identification, Application 
Firewall, Application Quality of Service, and 
Application Tracking) 


Advanced 2 


Includes standard and Advanced 1 features, 
Sophos antivirus, Web filtering, Antispam, and 
content filtering 


Advanced 3 


Includes standard and Advanced 1 features, 
Avira antivirus, Web filtering, Antispam, and 
content filtering 


Premium 1 


Includes standard and Advanced 1 features, and 
ATP Cloud 


Premium 2 


Includes standard and Advanced 2 features, and 
ATP Cloud 


Premium 3 


Includes standard and Advanced 3 features, and 
ATP Cloud 


vSRX Flex Software Subscription Model supports standard, advanced, or premium subscription license. 


Subscription term is 1 year, 3 years, or 5 years and includes customer support. 


For public cloud, vSRX Flex Software Subscription Model supports—Pay-As-You-Go (PAYG) and Bring 


Your Own License (BYOL) license model. Pricing is based on number of vCPU cores, with a minimum of 


2 vCPU cores. 


Table 32 on page 46 shows vSRX SKU definition. 


Table 32: vSRX SKU Definition 


SKU 


S-VSRX-2C/5C/9C/17C-S/A1/A2/A3/P1/P2/P3-1/3/5 
Example: 


e S-VSRX-2C-S-1 

e S-VSRX-5C-S-3 
S-VSRX-9C-S-5 
S-VSRX-5C-A1-1 
S-VSRX-17C-A2-3 
S-VSRX-17C-A3-5 
S-VSRX-5C-P1-1 
S-VSRX-17C-P2-3 
S-VSRX-17C-P3-5 


| HealthBot Licensing 


IN THIS SECTION 


@ = HealthBot Licensing Overview | 46 


@ = Managing HealthBot Licenses | 49 


HealthBot Licensing Overview 
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SKU Character Description 


S—Software 

VSRX—Product name vSRX 
2C/5C/9C/17C—Number of vCPUs 
S/A1/A2/A3/P1/P2/P3 


e S = Standard license model 

e Ai = Advanced 1 license model 
e A2 = Advanced 2 license model 
e A3 = Advanced 3 license model 
e P1 = Premium 1 license model 
e P2 = Premium 2 license model 


e P3 = Premium 3 license model 


1/3/5—Subscription term 1, 3, or 5 years 


Juniper Networks introduced the Juniper Flex Software Subscription Licensing model to provide an efficient 


way for customers and partners to manage licenses for hardware and software features. Contrail HealthBot 


uses this licensing model. 


To use a licensed feature, you need to purchase and activate a license that corresponds to that feature 


and deploy that license so that it can be utilized by the software during normal operation. You can administer 


and manage the licenses through the Juniper Agile Licensing Portal. The portal provides an intuitive, 


task-based user interface that provides full lifecycle management of licenses. 
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HealthBot supports the standalone mode for deploying licenses. Standalone mode allows you to activate 


a license on a software instance. Such a license can only be used by the instance on which it is activated. 


Sharing a license with multiple instances is not permissible. 


HealthBot has three service levels: 


HealthBot Standard (Free)—This is the free model solution and is available for customers that have a valid 


support contract. No license is required. 


HealthBot Advanced-—This is the first tier of the fee-based model solution and requires that you purchase 


a HealthBot Advanced feature license. You may purchase additional device-based feature licenses 


depending on your business needs. 


HealthBot Premium-—This is the second tier of the fee-based model solution and requires that you purchase 


a HealthBot Premium feature license. You may purchase additional device-based feature licenses 


depending on your business needs. 


The following table shows a comparison between the HealthBot service models: 


HealthBot Standard (Free) 


Free with a valid Juniper 
support contract. 


No license required. 


Limit of 5 custom playbooks 
and 10 custom rules. 


Number of devices allowed is 
based on your contractual 
agreement. 


Limited support for generating 
reports. You cannot configure 
reports settings. 


HealthBot Advanced (Fee-based) 


Access to advanced features. You must 
purchase a HealthBot Advanced feature 
license. Additional device feature licenses 
available. 


Subscription licenses. 


Unlimited custom playbooks and custom 
rules. 


Number of devices allowed is based on 
the number of device feature licenses 


purchased. 


Full support for generating reports. 


HealthBot Premium (Fee-based) 


Access to premium features. You must 
purchase a HealthBot Premium feature 
license. Additional device feature licenses 
available. 


The premium feature set currently 
includes Time Series Database (TSDB) 
High Availability (HA). 


Subscription licenses. 


Unlimited custom playbooks and custom 
rules. 


Number of devices allowed is based on 


device feature licenses purchased. 


Full support for generating reports. 


HealthBot Standard (Free) 


Limited support for generating 
notifications (only local, no 
external). You cannot 
configure notifications 
settings. 


HealthBot Advanced (Fee-based) 


Full support for generating notifications. 


Limited support for Time Series Database 
(TSDB) HA settings. You cannot configure 
TSDB HA settings. 


Support for default and custom rules with 
machine learning features such as 
dynamic thresholds, outlier detection, 
median prediction, and microburst. 


Support for default and custom rules with 
user-defined functions. 


Multivendor telemetry data collection. 
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HealthBot Premium (Fee-based) 


Full support for generating notifications 


Full support for changing TSDB HA and 
other TSDB settings. 


Support for default and custom rules with 
machine learning features such as 
dynamic thresholds, outlier detection, 
median prediction, and microburst. 


Support for default and custom rules with 
user-defined functions. 


Multivendor telemetry data collection. 


*For information about HealthBot product options or to obtain a trial license, contact your local sales 


representative. 


The following table lists the available HealthBot device feature licenses: 


Device Feature Name 


HBOT-C1 


HBOT-C2 


HBOT-C3 


HBOT-C4 


Description 


Extra small devices such as small remote CPEs, small branch SRX, and small 


ACX. 


Small switches such as fixed form factor EX, ACX, and QFX. 


Small chassis-based switches, routers, and firewalls such as MX10003 and 


PTX10K3 


Large chassis-based systems like the MX10K, PTX, and large SRX. 
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NOTE: In HealthBot releases prior to 3.1.0, the feature licenses were called HBOT-BASE, 
HBOT-G1, and HBOT-G2. License purchases made in previous versions will be honored in 
HealthBot 3.1.0. New license purchases as of 3.1.0 can not be applied to previous versions of 
HealthBot. See your local account manager for details. 


For the HealthBot 3.1.0 release, enforcement of device license counts is based on the total number of all 
C1-C4 licenses installed minus the total number of licenses actually used. This enforcement model may 
change in future releases of HealthBot. 


Managing HealthBot Licenses 


IN THIS SECTION 


@ Adda License to HealthBot | 49 


@ View Licensing Status in HealthBot | 50 


Once you have obtained a HealthBot license through the Juniper Agile Licensing Portal, you can: 


Add a License to HealthBot 
To add a HealthBot license: 


1. Click on the Settings > License Management option in the left-nav bar. 


2. Click the + License button. 


3. Click the Choose File button in the pop-up window. 


4. Navigate to the license file you want to add, and then click Open. 


5. Click the Add button to add the license file. 


The file should now appear in the Licenses Added table on the License Management page. For 
information about the Licenses Added table, see “Licenses Added” on page 51. 
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View Licensing Status in HealthBot 


IN THIS SECTION 


@ Features Summary | 50 
@ Licenses Added | 51 


The License Management page consists of two tables; the Features Summary table and the Licenses added 
table. Details of the table contents are shown below. 


Features Summary 
The following table describes the HealthBot feature license attributes in the Features Summary table: 


Attribute Description 


Feature HealthBot license name. 


HBOT-Premium—Limit and usage count for premium feature licenses for this 
instance of HealthBot 


HBOT-Advanced—Limit and usage count for advanced feature licenses for this 
instance of HealthBot 


HBOT-Devices—Maximum number of devices that can be managed by this 
instance of HealthBot based on the device feature licenses added. 


Description Brief description of the HealthBot feature license. 

License Limit The number of valid HealthBot licenses successfully added and available for 
use. 

Usage Count The number of available licenses that are currently in use in this instance of 
HealthBot. 


Valid Until Date and time when the license expires. 


Attribute 


Compliance 


Licenses Added 


51 


Description 


Color definitions for dot indicator: 


Green—Feature licenses are in compliance with Juniper's End User License 
Agreement. 


Yellow—Device feature licenses are >= 90% of the limit. You are getting close 
to running out of licenses. This status is only applicable to device feature 
licenses. 


Red—Feature licenses are not in compliance with Juniper's End User License 
Agreement. Click on the red dot to view details about the compliance issue. 


The following table describes the HealthBot license attributes in the Licenses Added table. Click the caret 
next to the License ID to view the features that are provided by the license ID. 


Attribute 


License ID 


SKU Name 


Customer ID 


Order Type 


Validity Type 


Start Date 


End Date 


Feature ID 


Feature Name 


Feature Description 


Description 


Identification number for the HealthBot license generated through the Juniper 
Agile Licensing Portal. 


Name of the HealthBot software licensing package. 


Identification name for the customer. 


Types include: Commercial, demo, education, emergency, lab, and unknown. 


Types include: Date-based or permanent. 


Start date of the HealthBot license. 


End date of the HealthBot license. 


Identification number for the feature license. 


HealthBot feature license name. For more information, see “Features Summary” 
on page 50. 


Brief description of the HealthBot feature license. 
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Attribute Description 


License Count HBOT-Premium—Allow premium capabilities in HealthBot 
HBOT-Advanced—Allow advanced capabilities in HealthBot 
HBOT-C1i—Number of C1 devices that can be managed by HealthBot.. 
HBOT-C2—Number of C2 devices that can be managed by HealthBot. 
HBOT-C3—Number of C3 devices that can be managed by HealthBot. 


HBOT-C4—Number of C4 devices that can be managed by HealthBot . 


Release History Table 


Release Description 


3.10 For the HealthBot 3.1.0 release, enforcement of device license counts is based on the total 
number of all C1-C4 licenses installed minus the total number of licenses actually used. 


Software Licenses 


Overview | 54 

Licenses for Routing Devices | 104 

Licenses for Switching Devices | 150 

Licenses for Security Devices | 197 

Licenses for Network Management | 287 
Licenses for Contrail Service Orchestration | 310 


Licenses for Steel-Belted Radius® Carrier | 320 





CHAPTER 2 


Overview 


IN THIS CHAPTER 


@ Software License Overview | 54 
@ Download and Activate Your Software | 63 


@ = Managing Licenses | 63 


| Software License Overview 


IN THIS SECTION 


Platforms Supported in the Licensing Guide | 54 


® 
@ = Junos OS Feature Licenses | 55 
@ License Enforcement | 56 

e 


Junos OS Feature License Keys | 57 


Platforms Supported in the Licensing Guide 


This guide describes how to install, manage, and monitor licenses on Juniper Networks devices. 


Table 33 on page 55 shows the platforms supported in the licensing guide. 
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Table 33: Platforms Supported in the Licensing Guide 


Category Platforms 


Juniper Flex Program ACX710, ACX5448, ACX5448-D, ACX5448-M, Contrail Enterprise Data Center, 
Contrail Cloud and Contrail Networking, cRPD, Contrail Service Orchestration, cSRX, 
EX2300, EX3400, EX4300, JATP400, JATP700, and ATP Virtual Appliance, HealthBot, 
MPC10E, MX2K-MPC11E, MX10K3-L2103, MX10K-LC2101 Line Cards and MX204 
Routers, MX-SPC3 Services Card, NFX350, PTX10003, PTX10008, QFX5110-48S, 
QFX5110-32Q, QFX5120-48Y, QFX5120-48T, QFX5120-32C, QFX5200-32C, 
QFX5210-64C, QFX5220-32CD, QFX5220-128C, SRX Series Services Gateways, 


and vSRX 
Routing cRPD, M Series, MX Series, PTX Series, T Series, and VMX 
Security SRX Series and vSRX 
Switching EX Series, QFX Series, and QFabric System 
Network Management Junos Space, Network and Security Manager (NSM), and J-Web Device Manager 


Contrail Service Orchestration | Contrail Service Orchestration (CSO) 


Steel-Belted Radius Carrier Steel-Belted Radius (SBR) or OAC or IMS AAA (formerly Funk) 


Junos OS Feature Licenses 


Some Junos OS software features require a license to activate the feature. To enable a licensed feature, 
you need to purchase, install, manage, and verify a license key that corresponds to each licensed feature. 
To conform to Junos OS feature licensing requirements, you must purchase one license per feature per 
device. The presence of the appropriate software license key on your device determines whether you are 
eligible to configure and use the licensed feature. 


To speed deployment of licensed features, Junos OS software implements an honor-based licensing 
structure and provides you with a 30-day grace period to use a licensed feature without a license key 
installed. The grace period begins when you configure the feature and your device uses the licensed feature 
for the first time, but not necessarily when you install the license. After the grace period expires, the system 
generates system log messages saying that the feature requires a license. To clear the error message and 
use the licensed feature properly, you must install and verify the required license. 


Data center customers, for example those using the QFX platform, use universal licenses. Starting in Junos 
OS Release 15.1, to ensure that license keys are used properly, Juniper Networks license key generation 
is enhanced to specify a customer ID in the license key. You can see the customer ID displayed in the 
output of the show system license command. 
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For information about how to purchase software licenses, contact your Juniper Networks sales 
representative. 


SEE ALSO 


Verifying Junos OS License Installation (CLI) | 73 


show system license | 76 


License Enforcement 


For features or scaling levels that require a license, you must install and properly configure the license to 
meet the requirements for using the licensable feature or scale level. The device enables you to commit 
a configuration that specifies a licensable feature or scale without a license for a 30-day grace period. The 
grace period is a short-term grant that enables you to start using features in the pack or scale up to the 
system limits (regardless of the license key limit) without a license key installed. The grace period begins 
when the licensable feature or scaling level is actually used by the device (not when it is first committed). 
In other words, you can commit licensable features or scaling limits to the device configuration, but the 
grace period does not begin until the device uses the licensable feature or exceeds a licensable scaling 
level. 


Configurations might include both licensed and nonlicensed features. For these situations, the license is 
enforced up to the point where the license can be clearly distinguished. For example, an authentication-order 
configuration is shared by both Authentication, Authorization, and Accounting (AAA), which is licensed, 
and by Layer 2 Tunneling Protocol (L2TP), which is not licensed. When the configuration is committed, 
the device does not issue any license warnings, because it is not yet known whether AAA or L2TP is using 
the configuration. However, at runtime, the device checks for a license when AAA authenticates clients, 
but does not check when L2TP authenticates clients. 


The device reports any license breach as a warning log message whenever a configuration is committed 
that contains a feature or scale limit usage that requires a license. Following the 30-day grace period, the 
device periodically reports the breach to syslog messages until a license is installed and properly configured 
on the device to resolve the breach. 


Successful commitment of a licensable feature or scaling configuration does not imply that the required 
licenses are installed or not required. If a required license is not present, the system issues a warning 
message after it commits the configuration. 


SEE ALSO 


Adding New Licenses (CLI Procedure) | 64 
Deleting License Keys (CLI) | 70 
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Saving License Keys (CLI) | 75 
Verifying Junos OS License Installation (CLI) | 73 
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IN THIS SECTION 


License Key Components | 57 
License Management Fields Summary | 57 
Release-Tied License Keys and Upgrade Licenses on MX Series Routers | 59 


Licensable Ports on MX5, MX10, and MX40 Routers | 60 


Port Activation on MX104 Routers | 61 


This section contains the following topics: 
License Key Components 
A license key consists of two parts: 


e License |ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, 
it is given a license ID. 


e License data—Block of binary data that defines and stores all license key objects. 


For example, in the following typical license key, the string XXXXXXXXXxX is the license ID, and the trailing 
block of data is the license data: 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
RKXKMK KXKRRKK KKKKKX KRKMKRX KKRKKM KRM KK 


XXXXXX XXXXXX XXX 


The license data defines the device ID for which the license is valid and the version of the license. 


License Management Fields Summary 


The Licenses page displays a summary of licensed features that are configured on the device and a list of 
licenses that are installed on the device. The information on the license management page is summarized 
in Table 34 on page 58. 
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Table 34: Summary of License Management Fields 


Field Name 


Feature Summary 


Feature 


Licenses Used 


Licenses Installed 


Licenses Needed 


Installed Licenses 


ID 


State 


Version 


Group 


Enabled Features 


Expiry 


Definition 


Name of the licensed feature: 


e Features—Software feature licenses. 


e All features—All-inclusive licenses 


Number of licenses currently being used on the device. Usage is determined by the 
configuration on the device. If a feature license exists and that feature is configured, 
the license is considered used. 


Number of licenses installed on the device for the particular feature. 
Number of licenses required for legal use of the feature. Usage is determined by the 


configuration on the device: If a feature is configured and the license for that feature 


is not installed, a single license is needed. 


Unique alphanumeric ID of the license. 


Valid—The installed license key is valid. 


Invalid—The installed license key is not valid. 


Numeric version number of the license key. 


If the license defines a group license, this field displays the group definition. 
If the license requires a group license, this field displays the required group definition. 


Because group licenses are currently unsupported, this field is always blank. 


Name of the feature that is enabled with the particular license. 


Verify that the expiration information for the license is correct. 


For Junos OS, only permanent licenses are supported. If a license has expired, it is 
shown as invalid. 


To speed deployment of licensed features, Juniper Networks implements an honor-based licensing structure 


and provides you with a 30-day grace period to use a licensed feature without a license key installed. The 


grace period begins when you configure the feature and your device uses the licensed feature for the first 
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time, but not necessarily when you install the license. After the grace period expires, the system generates 
system log messages saying that the feature requires a license. To clear the error message and use the 
licensed feature properly, you must install and verify the required license. 


Data center customers, for example those using the QFX platform, use universal licenses. Starting in Junos 
OS Release 15.1, to ensure that license keys are used properly, Juniper Networks license key generation 
is enhanced to specify a customer ID in the license key. You can see the customer ID displayed in the 
output of the show system license command. 


Release-Tied License Keys and Upgrade Licenses on MX Series Routers 


The Junos OS licensing infrastructure currently associates a license feature with attributes such as date, 
platform, and validity. In addition to these attributes, for MX Series routers running Junos OS Release 12.2 
and later, a licensed feature can be associated with a release number at the time of generating the license 
key. This type of release-tied license key is used to validate a particular licensed feature while attempting 
a software upgrade. The upgrade process aborts if the release number in the license key is earlier than the 
Junos OS release number to which the system is being upgraded. 


Additionally, an upgrade license key can be generated for a release-tied licensed feature. An upgrade 
license key is used for carrying forward a capacity license to the upgrade release. Although an upgrade 
license might be an acceptable license on the current release, it does not add to the existing capacity limit. 
The capacity added in the upgrade license key is valid for the upgrade software release only. 


The release number embedded in the license key indicates the maximum release number up to which 
Junos OS can be upgraded. 


As an example, assume that your system is running Junos OS Release 12.2 and is using the scale-subscriber 
licensed feature with a later release-tied upgrade license key installed. If you request a software upgrade 
to the later release of Junos OS, the software upgrade operation fails and the following error message is 
displayed: 





mgd: error: No valid upgrade license found for feature 'scale-subscriber'. 
Aborting Software upgrade. 
Validation failed 


In this example, to successfully upgrade to the later release of Junos OS, the release number included in 
the upgrade license key should be greater than or equal to the later release number. Also, you can perform 
software upgrades up to the previous release without any additional license keys to retain the existing 
scale limit. 


When you install a release-tied license, the following apply: 


e You can purchase an upgrade capacity license only if a base capacity license for the same scale-tier has 
already been generated or purchased. 


e You cannot install an upgrade license if the capacity does not match any of the existing base capacity 
licenses on the system. 
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e The license installation fails when you install a lower release number license key on a higher software 
release number. 


e A release-tied license can be installed on a Junos OS release number that is lower than or equal to the 
release number included in the license key. For example, a 12.2 license key is valid on Junos OS Release 
12.1. 


e An upgrade license is valid only on the target release number specified in the license key, but can be 
installed on an earlier Junos OS release. For example, a 4 K scale-tier upgrade license for Junos OS 
Release 12.2 can be installed on an earlier release, and the installed count of licenses remains unaltered. 


Release-tied licenses of the previous release are not deleted on upgrading Junos OS to a newer release 
version. 


Licensable Ports on MX5, MX10, and MX40 Routers 


Starting with Junos OS Release 12.2, license keys are available to enhance the port capacity on MX5, 
MxX10, and MX40 routers up to the port capacity of an MX80 router. The MX5, MX10, and MX40 routers 
are derived from the modular MX80 chassis with similar slot and port assignments, and provide all 
functionality available on an MX80 router, but at a lower capacity. Restricting port capacity is achieved 
by making a set of MIC slots and ports licensable. MICs without a license are locked, and are unlocked or 
made usable by installing appropriate upgrade licenses. 


The base capacity of a router is identified by the Ideeprom assembly ID (I2C ID), which defines the board 
type. However, the Junos OS licensing infrastructure allows the use of restricted ports without a license 
for a grace period of 30 days. After the grace period expires, the router reverts back to the base capacity 
if no upgrade license is purchased and installed for the locked ports. The 12C ID along with an upgrade 
license determine the final capacity of an MX5, MX10, or MX40 router. 


The MX5, MX10, MX40, and MX80 routers support the following types of MICs: 
e A built-in 10-Gigabit Ethernet MIC with four 10-Gigabit Ethernet ports 
e Two front-pluggable MICs 


A feature ID is assigned to every license upgrade for enhancing port capacity. Table 35 on page 61 displays 
the chassis types and their associated port capacity, I2C ID, base capacity, feature ID, feature name, and 
the final capacity after a license upgrade. 
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Table 35: Upgrade Licenses for Enhancing Port Capacity 


Feature 
ID and 
Chassis Port Feature 
Type Gpaty I2C ID Base Capacity Name Upgrade Capacity 
MX5 20G 0x556 Slot 1 f1—MX5 Slot 1 and 2 
to MX10 
e 1/MICO e 1/MICO 
upgrade 
e 1/MIC1 
MxX10 40G 0x555 Slot 1 and 2 f2—MX10 | Slot 2 and first 2 ports on Slot 0 
to MX40 
e 1/MICO e 1/MIC1 
upgrade 
e 1/MIC1 e First 2 ports on O/MICO 
MxX40 60G 0x554 Slot 1, SLot 2 and first 2 | f3—MX40 — Slot 2 and all ports on Slot O 
ports on Slot 0 to MX80 
e 1/MIC1 
upgrade 
e 1/MICO e All 4 ports on 0/MICO 
e 1/MIC1 


e First 2 ports on 
0/MICO 


When installing an upgrade license for enhancing port capacity on MX5, MX10 and MX40 routers, consider 
the following: 


e To upgrade an MX5 router to MX80 router capacity, licenses for all three features (f1, f2, £3) must be 
installed. All three features can be provided in a single license key. 


e Toupgrade an MX10 router to MX40 router capacity, installing a license key with f2 feature is sufficient. 
e Non-applicable feature IDs in a license key reject the upgrade license. For example: 
e An f1 feature ID on an MX10 upgrade license key rejects the license. 


e Feature IDs f1 and f2 on an MX40 upgrade license key reject the entire license. 


Port Activation on MX104 Routers 


Starting with Junos OS Release 13.3, license keys are available to activate the ports on the MX104 router. 
MxX104 routers have four built-in ports. By default, in the absence of valid licenses, all four built-in ports 
are deactivated. By installing licenses, you can activate any two of the four or all of the four built-in ports. 
For instance, you can install a license to activate the first two built-in ports (xe-2/0/0 and xe-2/0/1) or 
you can install a license to activate the next two built-in ports (xe-2/0/2 and xe-2/0/3). You can also install 
a license to activate all four built-in ports (xe-2/0/0, xe-2/0/1, xe-2/0/2, and xe-2/0/3). If you have already 
activated two of the built-in ports, you can install an additional license to activate the other two built-in 
ports on the MX104 router. 
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A feature ID is assigned to every license for activating the built-in ports on the MX104 router. The port 
license model with the feature ID is described in Table 36 on page 62. 


Table 36: Port Activation License Model for MX104 Routers 


Feature ID Feature Name Functionality 


F1 MX104 2X10G Port Activate (Oand1) | Ability to activate first two built-in ports (xe-2/0/0 
and xe-2/0/1) 


F2 MX104 2X10G Port Activate (2 and3) Ability to activate next two built-in ports (xe-2/0/2 
and xe-2/0/3) 


Both the features are also provided in a single license key for ease of use. To activate all four ports, you 
must either install the licenses for both the features listed in Table 36 on page 62 or the single license key 
for both features. If you install the single license key when feature IDs F1 and F2 are already installed, the 
license does not get rejected. Also, MX104 routers do not support the graceful license expiry policy. A 
graceful license expiry policy allows the use of a feature for a certain period of time (usually a grace period 
of 30 days), and reverts if the license for that feature is not installed after the grace period. 


SEE ALSO 


Updating License Keys (CLI) | 240 


Release History Table 


Release Description 


15.1 Starting in Junos OS Release 15.1, to ensure that license keys are used properly, Juniper 
Networks license key generation is enhanced to specify a customer ID in the license key. 


RELATED DOCUMENTATION 


Managing Licenses | 63 
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| Download and Activate Your Software 


1. Gather your activation codes. 


e Activation Code: The 17-digit alphanumeric activation code is sent through email in response to your 
order and is used to generate license capacity / feature activation key(s) for your Juniper Networks 
software. The activation code is used to generate your license activation key—it is not the license 
activation key itself. 


2. Download Software 


Go to Juniper's Support Downloads page. A Juniper Customer Support Center (CSC) user account is 
needed to access support content. (If you do not already have an account, go to Login Assistance.) 
Look for and click on your software’s product line and download the software 


3. Install the software according to the instructions in the product documentation. 


4. Generate and install license activation key(s). 


Upon initial setup, a base activation key might be required to activate the software. If further capacity 
or feature(s) were purchased and are being added to the software, each capacity increment and feature 
needs to be added via another activation key.Generate license activation keys using the Juniper Agile 
Licensing Portal. At the top of the portal, enter your activation code, and click Activate. Then follow 
the instructions on screen. Juniper provides license activation keys in one of two ways: 


e Download: You can download activation keys from the Juniper Agile Licensing Portal. 
e Email: You receive an email that contains the license activation key(s). 
5. Obtain internet activation. 


The software might need to contact the Juniper Agile Licensing Portal through the internet as part of 
the activation sequence. 


| Managing Licenses 


IN THIS SECTION 


Adding New Licenses (CLI Procedure) | 64 
Deleting License Keys (CLI) | 70 
Verifying Junos OS License Installation (CLI) | 73 


Saving License Keys (CLI) | 75 


show system license | 76 

show system license (View) | 88 
traceoptions (System License) | 92 
request system license add | 94 
request system license save | 96 
request system license update | 98 
request system license delete | 100 


license | 101 


license-type | 103 


Adding New Licenses (CLI Procedure) 


IN THIS SECTION 


@ Installing a License Using a Configuration Statement | 65 


@ Installing a License Using an Operational Command | 69 


Before adding new licenses, complete the following tasks: 


e Purchase the required licenses. 


e Establish basic network connectivity with the router or switch. For instructions on establishing basic 
connectivity, see the Getting Started Guide or Quick Start Guide for your device. 


There are two ways to add licenses using the Junos OS CLI: 


e The system license keys key configuration statement enables you to configure and delete license keys 
in a Junos OS CLI configuration file. 


e The request system license add operational command installs a license through URL or using the license 
file. 


On QFabric systems, install your licenses in the default partition of the QFabric system and not on the 
individual components (Node devices and Interconnect devices). 


To add licenses, complete one of the following procedures: 
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Installing a License Using a Configuration Statement 


IN THIS SECTION 


@ Installing Licenses Using the CLI Directly | 65 


@ Installing Licenses Using a Configuration File | 66 


Starting with Junos OS Release 15.1, you can configure and delete license keys in a Junos OS CLI 
configuration file. The system license keys key statement at the [edit] hierarchy level installs a license by 
using a configuration statement. 


The system license keys key configuration statement is not required to install a license. The operational 
command request system license add installs a license immediately. But because the set system license 
keys key command is a configuration statement, you can use it to install a license as part of a configuration 
commit, either directly or by configuration file. 


The license keys are validated and installed after a successful commit of the configuration file. If a license 
key is invalid, the commit fails and issues an error message. You can configure individual license keys or 
multiple license keys by issuing Junos OS CLI commands or by loading the license key configuration 
contained in a file. All installed license keys are stored in the /config/license/ directory. 


Select a procedure to install a license using configuration: 


Installing Licenses Using the CLI Directly 


To install an individual license key using the Junos OS CLI: 


1. Issue the set system license keys key name statement. 


The name parameter includes the license ID and the license key. For example: 


[edit] 
user@device# set system license keys key "JUNOS_TEST_LIC_FEAT xxxxxx XxXxXXX XXXXXX XXXXXX XXXXXX 
XXXXXX XXXXXX XXXXXX XXXXAXX XXXXKX XXXXAXK XXXXXKX XXXXKX" 


To install multiple license keys in the Junos OS CLI, issue the set system license keys key name statement 
for each license key to install. For example: 


[edit] 

user@device# set system license keys key "key_1" 
set system license keys key "key_2" 

set system license keys key "key_2" 

set system license keys key "key_4" 


2. Issue the commit command. 
[edit] 


user@device# commit 
commit complete 


3. Verify that the license key was installed. 


For example: 


user@device# run show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
sdk-test-—featl 0 iL 0 permanent 


Licenses installed: 

















License identifier: JUNOS_TEST_LIC_FEAT 





License version: 2 


Features: 





sdk-test-featl JUNOS SDK Test Feature 1 


permanent 


Alternatively, you can issue the show system license command from operational mode. 


Installing Licenses Using a Configuration File 


Before you begin, prepare the configuration file. In this example, use the Unix shell cat command to write 
the license.conf file: 


1. Go to the shell. 
[edit] 
user@device# exit 


user@device> exit 
% 


2. Open the new license.conf file. 


% cat > license.conf 
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3. Type the configuration information for the license key or keys: 


e For a single license, for example, type the following content: 


system { 
license { 


keys { 





key "JUNOS_T 





EST LIC_F 





FAT XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 





XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX SOOO S 


} 


e For multiple license keys, for example, type something like this: 


system { 


license { 


keys { 
key "key_1" 
key "key_2" 
key "key_3" 
key "key_n" 


} 


4. Press Ctrl+d to save the file. 


To install a license key configuration in a file: 


1. Go to the CLI configuration mode. 


% cli 

user@device> configure 
[edit] 

user@device# 


2. Load and merge the license configuration file. 


For example: 
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5. 
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user@device# load merge license.conf 
load complete 


Issue the show | compare command to see the configuration. 


For example: 


[edit] 
user@device# show | compare 
[edit system] 

+ license { 


+ keys { 








oF key "JUNOS_TEST_LIC_FEAT xxxxxxX XXXXXX XXXXXK XXXXXX XXXXXX XXKXXXX 
ROOOOOK KOIOCSOOK YONG OOR AOIOGOOOK AOSOGOK MOWOLOIOOK rowan s 


* } 





Issue the commit command. 


[edit] 


user@device# commit 


To verify that the license key was installed, issue the show system license command. 


For example: 


root@switch> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
sdk-test-—featl 0 1 0 permanent 


Licenses installed: 

















License identifier: JUNOS_TEST_LIC_FEAT 





License version: 2 
Features: 


sdk-test-—featl JUNOS SDK Test Feature 1 





permanent 
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Reboot the device after license installation on the SRX300, SRX320, SRX320-POE, SRX340, SRX345, 
SRX380, SRX550, and SRX550-M devices. Rebooting the device sets system resources to support session 
capacity of the installed license. 


Installing a License Using an Operational Command 


IN THIS SECTION 


@ = Adding a License to a Device with a Single Routing Engine | 69 


@ Adding a License to a Device with Dual Routing Engines | 69 


Complete the procedure that relates to your system: 

Adding a License to a Device with a Single Routing Engine 

To add a new license key to the device using an operational command: 

1. From the CLI operational mode, enter one of the following CLI commands: 


e To add alicense key from a file or URL, enter the following command, specifying the filename or the 
URL where the key is located: 


user@host> request system license add filename | url 
e To add a license key from the terminal, enter the following command: 
user@host> request system license add terminal 


2. When prompted, enter the license key, separating multiple license keys with a blank line. 


If the license key you enter is invalid, an error appears in the CLI output when you press Ctrl+d to exit 
license entry mode. 


3. Go on to “Verifying Junos OS License Installation (CLI)” on page 73. 


Adding a License to a Device with Dual Routing Engines 


On routers that have graceful Routing Engine switchover (GRES) enabled, after successfully adding the 
new license on the master Routing Engine, the license keys are automatically synchronized on the backup 
Routing Engine as well. However, in case GRES is not enabled, the new license is added on each Routing 
Engine separately. This ensures that the license key is enabled on the backup Routing Engine during 
changeover of mastership between the Routing Engines. 
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To add a new license key to a router with dual Routing Engines without GRES: 


1. After adding the new license key on the master Routing Engine, use the request chassis routing-engine 
master switch command to have the backup Routing Engine become the master Routing Engine. 


2. Log in to the active Routing Engine and add the new license key, repeat the same step. 


Adding a license key to the router or switch might be delayed if a kernel resynchronization operation is in 
progress at that time. The following message is displayed on the CLI when the license-adding operation 
is about to be delayed: 

A kernel re-sync operation is in progress. License update may take several minutes to complete. 


SEE ALSO 


Junos OS Feature Licenses | 55 


IDP Basic Configuration 


Deleting License Keys (CLI) 


IN THIS SECTION 


@ Using the Operational Command to Delete Licenses | 70 


@ Using a Configuration Command to Delete Licenses | 71 


Before deleting a license, ensure that the features enabled by the license will not be needed. 


You can use the request system license delete operational command, or the delete or deactivate 
configuration command to delete a license: 


Using the Operational Command to Delete Licenses 


To delete licenses using the request system license delete command: 


1. Display the licenses available to be deleted. 


user@host> request system license delete license-identifier-list ? 


Possible completions: 

E00468XxXx4 License key identifier 
JUNOS10XXX1 License key identifier 
JUNOS10XXX2 License key identifier 














71 


JUNOS10XXX3 License key identifier 








JUNOS10XXX4 License key identifier 


[ Open a set of values 


2. Todelete a license key or keys from a device using the CLI operational mode, select one of the following 
methods: 


e Delete a single license by specifying the license ID. Using this option, you can delete only one license 
at a time. 


user@host> request system license delete license-identifier 


e Delete all license keys from the device. 


user@host> request system license delete all 


e Delete multiple license keys from the device. Specify the license identifier for each key and enclose 
the list of identifiers in brackets. 


user@host> request system license delete license-identifier-list JJUNOS10XXX1 JUNOS10XXX3 
JUNOS10XXxX¢4...] 


Delete license(s) ? 


[yes,no] (no) yes 


3. Verify the license was deleted by entering the show system license command. 


Using a Configuration Command to Delete Licenses 


Starting in Junos OS Release 16.1, to remove licenses from the configuration, you can use either the delete 
or deactivate configuration command. The delete command deletes a statement or identifier, and all 

subordinate statements and identifiers contained within the specified statement path are deleted with it. 
The deactivate command adds the inactive: tag to a statement, effectively commenting out the statement 
or identifier from the configuration. Statements or identifiers marked as inactive do not take effect when 
you issue the commit command. To remove the inactive: tag from a statement, issue the activate command. 
Statements or identifiers that have been activated take effect when you next issue the commit command. 


The following procedure uses the delete command, but you could use the deactivate command as well. 


To delete one or all licenses using the delete command: 


You can use the deactivate command instead of the delete command in this procedure. 


1. 


Display the licenses available to be deleted. 


Issue the run request system license delete license-identifier-list ? command from the configuration 
mode of the CLI. 


[edit] 
user@host# run request system license delete license-identifier-list ? 


A list of licenses on the device is displayed: 


Possible completions: 




















E00468xXxXx4 License key identifier 
JUNOS10XXX1 License key identifier 
JUNOS10XXX2 License key identifier 
JUNOS10XXX3 License key identifier 
JUNOS10XXxX4 License key identifier 


[: Open a set of values 


Delete the license or licenses you want. 


e To delete a single license, for example: 


[edit] 
user@host# delete system license keys key “EOO468XXX4” 


e To delete all licenses, for example: 


[edit] 
user@host# delete system license keys 


Commit the configuration by entering the commit command. 


Verify the license was deleted by entering the show system license command. 


72 


Verifying Junos OS License Installation (CLI) 


IN THIS SECTION 


@ Displaying Installed Licenses | 73 
@ Displaying License Usage | 74 


To verify Junos OS license management, perform the following tasks: 


Displaying Installed Licenses 


Purpose 


Verify that the expected licenses are installed and active on the device. 


Action 


From the CLI, enter the show system license command. 


Sample Output 


user@host> show system license 


License usage: 


Licenses Licenses Licenses 
Feature name used installed needed 
subscriber-acct 0 1 0 
subscriber-auth 0 il 0 
subscriber-addr 0 il 0 
subscriber-vlan 0 ib 0 
subscriber-ip 0 il 0 
scale-subscriber 0 1000 0 
scale-l2tp 0 1000 0 
scale-mobile-ip 0 1000 0 





Licenses installed: 
License identifier: E000185416 











License version: 2 
INES UES} § 
subscriber-acct - Per Subscriber Radius Accounting 


permanent 





Expiry 


permanent 
permanent 
permanent 
permanent 
permanent 
permanent 
permanent 


permanent 
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subscriber-auth - Per Subscriber Radius Authentication 
permanent 

subscriber-addr Address Pool Assignment 
permanent 

subscriber-vlan - Dynamic Auto-sensed Vlan 
permanent 

subscriber-ip = DYNES eimel Sitaicwe: Iw! 
permanent 

Meaning 


The output shows a list of the license usage and a list of the licenses installed on the device. Verify the 
following information: 


e Each license is present. Licenses are listed in ascending alphanumeric order by license ID. 
e The state of each license is permanent. 


A state of invalid indicates that the license key is not a valid license key. Either it was entered incorrectly 
or it is not valid for the specific device. 


e The feature for each license is the expected feature. The features enabled are listed by license. An 
all-inclusive license has all features listed. 


e All configured features have the required licenses installed. The Licenses needed column must show 
that no licenses are required. 


Displaying License Usage 


Purpose 


Verify that the licenses fully cover the feature configuration on the device. 


Action 


From the CLI, enter the show system license usage command. 


Sample Output 


user@host> show system license usage 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
subscriber-addr il 0 il 29 days 


scale-subscriber 0 1000 0 permanent 
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scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
Meaning 


The output shows any licenses installed on the device and how they are used. Verify the following 
information: 


e Any configured licenses appear in the output. The output lists features in ascending alphabetical order 
by license name. The number of licenses appears in the third column. Verify that you have installed the 
appropriate number of licenses. 


e The number of licenses used matches the number of configured features. If a licensed feature is 
configured, the feature is considered used. The sample output shows that the subscriber address pooling 
feature is configured. 


e A license is installed on the device for each configured feature. For every feature configured that does 
not have a license, one license is needed. 


For example, the sample output shows that the subscriber address feature is configured but that the 
license for the feature has not yet been installed. The license must be installed within the remaining 
grace period to be in compliance. 


Saving License Keys (CLI) 


To save the licenses installed on a device: 


1. From operational mode, do one of the following tasks 


e To save the installed license keys to a file or URL, enter the following command: 
user@host> request system license save filename | url 
For example, the following command saves the installed license keys to a file named license.config: 
user@host> request system license save license.config 
e To output installed license keys to the terminal, enter the following command: 


user@host> request system license save terminal 
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show system license 


Syntax 


show system license 
<brief | detail | installed | key-content filename | keys | usage> 


Release Information 

Command introduced before Junos OS Release 7.4. 

Command introduced in Junos OS Release 9.0 for EX Series switches. 

Command introduced in Junos OS Release 11.1 for the QFX Series. 

Command introduced in Junos OS Release 13.3 for the MX Series 5G Universal Routing Platform. 
Customer ID added to output of data center users in Junos OS Release 15.1. 

Corrected output for duration of license added in Junos OS Release 17.4R1. 


Description 


Display licenses and information about how they are used. 


Options 
brief—Display brief output (default). 


detail—Display detailed output. 
installed—(Optional) Display installed licenses only. 
key-content filename—(Optional) Display license key contents of the specified filename. 


keys—(Optional) Display a list of license keys. Use this information to verify that each expected license 
key is present. 


usage—(Optional) Display the state of licensed features. 


Required Privilege Level 
maintenance 


List of Sample Output 

show system license (Virtual devices such as vMX and vSRX) on page 78 
show system license on page 79 

show system license installed on page 79 

show system license keys on page 80 

show system license usage on page 80 

show system license (MX104 Routers) on page 80 

show system license installed (MX104 Routers) on page 81 

show system license keys (MX104 Routers) on page 81 

show system license usage (MX104 Routers) on page 82 
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show system license (MX104 Routers) on page 82 
show system license installed (MX104 Routers) on page 83 
show system license keys (MX104 Routers) on page 83 


show system license usage (MX104 Routers) on page 83 
show system license (MX104 Routers) on page 84 

show system license installed (MX104 Routers) on page 84 
show system license keys (MX104 Routers) on page 85 


show system license usage (MX104 Routers) on page 85 

show system license (QFX Series) on page 85 

show system license (QFX5110 Switch with Disaggregated Feature License) on page 86 
show system license key-content srx_1year_sub.lic on page 87 


Output Fields 


Table 37 on page 77 lists the output fields for the show system license command. Output fields are listed 


in the approximate order in which they appear. 


Table 37: show system license Output Fields 


Field Name 


Feature name 


Licenses used 


Licenses installed 


Field Description 


Name assigned to the configured feature. You use this information to verify that all the features 
for which you installed licenses are present. 


Number of licenses used by a router or switch. You use this information to verify that the 
number of licenses used matches the number configured. If a licensed feature is configured, 
the feature is considered used. 


In Junos OS Release 10.1 and later, the Licenses used column displays the actual usage count 
based on the number of active sessions or connections as reported by the corresponding 
feature daemons. This is applicable for scalable license-based features such as Subscriber 
Access (scale-subscriber), L2TP (scale-I2tp), Mobile IP (scale-mobile-ip), and so on. 


Information about the installed license key: 


e License identifier—Identifier associated with a license key. 


e State—State of the license key:valid or invalid. An invalid state indicates that the key was 
entered incorrectly or is not valid for the specific device. 


e License version—Version of a license. The version indicates how the license is validated, 
the type of signature, and the signer of the license key. 


e Customer ID—Name of the customer license is for. Feature added as of Junos OS Release 
15.1 for data center customers (for example QFX Series platform users). 


e Valid for device—Device that can use a license key. 
e Group defined—Group membership of a device. 


e Features—Feature associated with a license, such as data link switching (DLSw). 


Table 37: show system license Output Fields (continued) 


Field Name Field Description 

Licenses needed Number of licenses required for features being used but not yet properly licensed. 

Expiry Amount of time left within the grace period before a license is required for a feature being 
used. 


| Sample Output 


show system license (Virtual devices such as vMX and vSRX) 


user@host> show system license 


License usage: 




















Licenses Licenses Licenses Expiry 

Feature name used installed needed 

VMX-SCALE 0 1 0 permanent 
VMX-BANDWIDTH 0 130000 0 permanent 
mobile-next-—DPI-bas 0 1000 0 permanent 
mobile-next-policy-prepaid-scaling 0 1000 0 permanent 
mobile-next—-http-app-scaling 0 1000 0 permanent 
mobile-next-scaling 0 1000 0 permanent 
logical-system 0 1 0 permanent 
ax411-wlan-ap 0 2 0 permanent 
dynamic-vpn 0 2 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-subscriber 0 64010 0 permanent 


Licenses installed: 


License identifier: RMS818090001 








License version: 1 
Software Serial Number: AID0O00000001 
Customer ID: LABJuniperTest 
License count: 1 
Healeusesi 
VMX-SCALI -— Max scale supported by the VMX 
ceiceoasecl, 2017-03-15 OSss0s00 ISt — 2O0LJ-O5—-14 OS330s00 UST 





Gl 





License identifier: RMS818020001 





License version: 1 


Software Serial Number: AID000000001 
Customer ID: vMX-JuniperNetworks 
License count: 1 

Features: 


VMX-SCAL 





Gu 


—- Max scale supported by the VMX 


permanent 


show system license 


user@host> show system license 


License usage: 
Licenses Licenses Licenses 

Feature name used installed needed 
subscriber-accounting 
subscriber-authentication 
subscriber-—address-—assignment 
subscriber-vlan 
subscriber-ip 
scale-subscriber 


scale-l2tp 


So RS aS RS [I bh 





RS) 16m) (3) sok Iso) RS SYS) 
oe eer ere 2s Se S&S 


scale-mobile-ip 


Licenses installed: 





License identifier: XXXXXXXXXX 





License version: 2 


Customer ID: ACME CORPORATIOM 





= 


INEVSNE UES) § 
subscriber-accounting - Per Subscriber Radius Accounting 
permanent 
subscriber-authentication - Per Subscriber Radius Authentication 
permanent 
subscriber-address-—assignment —- Radius/SRC Address Pool Assignment 
permanent 
subscriber-vlan -— Dynamic Auto-sensed Vlan 
permanent 


subscriber-ip = Dywneniale aincl Sieeirse ue 





permanent 


show system license installed 


user@host> show system license installed 





Expiry 


permanent 
permanent 
permanent 
permanent 
permanent 
permanent 
permanent 


permanent 
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License identifier: XXXXXXXXXX 








License version: 2 

IQVGNE WEISS} 8 

subscriber-accounting - Per Subscriber Radius Accounting 
permanent 

subscriber-authentication - Per Subscriber Radius Authentication 
permanent 

subscriber-address-—assignment —- Radius/SRC Address Pool Assignment 
permanent 

subscriber-vlan -— Dynamic Auto-sensed Vlan 
permanent 


subscriber-ip = DYNES gimel Sitaicae: wy 





permanent 


show system license keys 


user@host> show system license keys 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
XXXKXK XKXKKKM XKMKKK XKERMKK KMKKKKX KKXKEKX 


XXXXXX XXXXXX XXX 


show system license usage 


user@host> show system license usage 


License usage: 





Licenses Licenses Licenses Expiry 

Feature name used installed needed 

subscriber-accounting 2 2 0 permanent 
subscriber-authentication 1 z 0 permanent 
subscriber-—address-—assignment 2 Z 0 permanent 
subscriber-vlan Zz 2 0 permanent 
subscriber-ip 0 2 0 permanent 
scale-subscriber z 3 0 permanent 
scale-1l2tp 4 5 0 permanent 
scale-mobile-ip 1 2 0 permanent 





show system license (MX104 Routers) 


In the following output, ports O and 1 are activated by installing the license to activate the first two built-in 
ports. 
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user@host> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig-—port-0-1 0 1 0 permanent 


Licenses installed: 


License identifier: XXXXXXXXXX 








License version: 2 
Peatures: 


MX104-2x10Gig—port-—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 


show system license installed (MX104 Routers) 


In the following output, ports O and 1 are activated by installing the license to activate the first two built-in 
ports. 


user@host > show system license installed 


License identifier: XXXXXXXXXX 





License version: 2 
Peatures: 


MX104-2x10Gig—port—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 


show system license keys (MX104 Routers) 
In the following output, ports O and 1 are activated by installing the license to activate the first two built-in 


ports. 


user@host > show system license keys 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
RAMKRX KRXMKX XXRKMK KMXRKX HXKMKK MEKKMX 


XXXXXX XXXX 


show system license usage (MX104 Routers) 


In the following output, ports O and 1 are activated by installing the license to activate the first two built-in 
ports. 


user@host > show system license usage 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig—port—0-1 0 ll 0 permanent 


show system license (MX104 Routers) 


In the following output, ports 2 and 3 are activated by installing the license to activate the next two built-in 
ports after installing the license to activate the first two built-in ports. 


user@host > show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig-—port-0-1 0 1 0 permanent 
MX104-2x10Gig-—port-2-3 0 1 0 permanent 


Licenses installed: 


License identifier: XXXXXXXXXX 








License version: 2 
Features: 
MX104-2x10Gig-—port—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 


License identifier: XXXXXXXXXX 








License version: 2 
Features: 
MX104-2x10Gig-—port—2-3 -— MX104 2X10Gig Builtin Port (xe-2/0/2 & xe-2/0/3) upgrade 


permanent 


show system license installed (MX104 Routers) 


In the following output, ports 2 and 3 are activated by installing the license to activate the next two built-in 
ports after installing the license to activate the first two built-in ports. 


user@host > show system license installed 


License identifier: XXXXXXXXXX 





License version: 2 


Features: 


MX104-2x10Gig-port-—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 








License version: 2 


Features: 


MX104-2x10Gig—port-—2-3 - MX104 2X10Gig Builtin Port (xe-2/0/2 & xe-2/0/3) upgrade 


permanent 


License identifier: XXXXXXXXXX 


show system license keys (MX104 Routers) 


In the following output, ports 2 and 3 are activated by installing the license to activate the next two built-in 
ports after installing the license to activate the first two built-in ports. 


user@host > show system license keys 


XXXXXXXXXX XXXXXX XXXXXX 
RAMKKK KKXKERX 


XXXXXX XXXX 


XXXXXXXXXX XXXXXX XXXXXX 
XXXXXK XXKXXX 


XXXXXX XXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


show system license usage (MX104 Routers) 


In the following output, ports 2 and 3 are activated by installing the license to activate the next two built-in 
ports after installing the license to activate the first two built-in ports. 


user@host > show system license usage 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXXX 


XXXXKX 


XXXXXK 


XXXXXX 


XXXXKX 
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Licenses Licenses Licenses Expiry 


Feature name used installed needed 

scale-subscriber 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig—port—0-1 0 il 0 permanent 
MX104-2x10Gig-—port-2-3 0 al 0 permanent 


show system license (MX104 Routers) 


In the following output, ports 0,1,2, and 3 are activated by installing a single license key to activate all four 
built-in ports. 


user@host > show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-1l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig—port-0-1 0 ll 0 permanent 
MX104-2x10Gig—port-—2-3 0 1 0 permanent 


Licenses installed: 
License identifier: XXXXXXXXXX 








License version: 2 
Pealures: 
MX104-2x10Gig-—port—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 


MX104-2x10Gig—port—2-3 - MX104 2X10Gig Builtin Port (xe-2/0/2 & xe-2/0/3) upgrade 


permanent 


show system license installed (MX104 Routers) 


In the following output, ports 0,1,2, and 3 are activated by installing a single license key to activate all four 
built-in ports. 


user@host > show system license installed 





License identifier: XXXXXXXXXX 
License version: 2 


Features: 
MX104-2x10Gig-—port-—0-1 - MX104 2X10Gig Builtin Port (xe-2/0/0 & xe-2/0/1) upgrade 


permanent 
MX104-2x10Gig-—port-—2-3 - MX104 2X10Gig Builtin Port (xe-2/0/2 & xe-2/0/3) upgrade 


permanent 


show system license keys (MX104 Routers) 


In the following output, ports 0,1,2, and 3 are activated by installing a single license key to activate all four 


built-in ports. 


user@host > show system license keys 


XXXXXXXXX XMXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
RAMKKX KRXKKX KMKKKKK KXKKXX KRXXMKX 


XXXXXX XXXXXX X 


show system license usage (MX104 Routers) 


In the following output, ports 0,1,2, and 3 are activated by installing a single license key to activate all four 
built-in ports. 


user@host > show system license usage 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-l2tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
MX104-2x10Gig-—port-0-1 0 al 0 permanent 
MX104-2x10Gig-—port-2-3 0 il 0 permanent 


show system license (QFX Series) 


user@switch> show system license 


License usage: 





Licenses Licenses Licenses Expiry 


Feature name 


qfx-edge-fab 
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Licenses installed: 





Licens 





Features: 


identifier: 


qfx—-edge-fab 


permanent 


License usage: 


Feature name 


bgp 


00:00:00 UTC 


SHES 


OOOO OO RUE 


vxlan 


00:00:00 UTC 


ovsdb 


00:00:00 UTC 


siose: 


OOOO COREE 


upgradel 








VO BOO OOS ULE 


License version: 1 





used installed needed 
i i 1 permanent 
JUNOS417988 
= QFX3000 Series QF/Node feature licens 


show system license (QFX5110 Switch with Disaggregated Feature License) 


user@switch> show system license 














Licenses installed: 





Licens 





Software Serial Number: 


Customer ID: 


Features: 


JUNOS-BAS 
date-based, 


License version: 4 











Licenses Licenses Licenses Expiry 
used installed needed 
0 1 0 2017-07-05 
0 1 0 201 /—O 7-05 
0 1 0 ZO On OS 
0 1 0 2 Ona OPO 
0 i 0 AQ T=O0 7-02 
0 1 0 ZO0L7=—O07-05 
identifier: JUNOS797095 
91730A00223925 
Juniper 
F—-SERVICES-CLASS-1 - QFX Junos Base Services license for Class 1 HW 











AVIG—O7—Oi WOSOOSOO WHE = BOLT-O7-O2 OWZOOLOO wie 





Licens 





Software Serial Number: 


Customer ID: 


Pealures: 


identifier: 


JUNOS797646 


License version: 4 


91730A00224207 


Juniper 


= 





CLASS-—1—-JUNOS-BASE 


ADVANCED-UPGRADE - Class 1 Junos Base to Advanced Services 











Upgrade 


Geiceoasecl, 2016-07-04 WOOsOOsHO UWE — A2OLT-O7—-O5 OOSOMOsOO wre 


{master:0} 


show system license key-content srx_1year_sub.lic 


License Key Content: 
License Id: LICENSE-1 


License version: 4 

















Valid for device: CW2716AF0740 
Pestures: 
idp-sig - IDP Signature 


Ckice-oasecl, Z0IG-O7—-05 WOsOOsiO Exit — 2ZOLT-O7—-OS OOFOMOLOO Cimix 
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show system license (View) 


Syntax 


show system license 
<installed | keys | status | usage> 


Release Information 
Command introduced in Junos OS Release 9.5. Logical system status option added in Junos OS Release 
11.2. 


Description 


Display licenses and information about how licenses are used. 


Options 


none—Display all license information. 
installed—(Optional) Display installed licenses only. 


keys—(Optional) Display a list of license keys. Use this information to verify that each expected license 
key is present. 


status—(Optional) Display license status for a specified logical system or for all logical systems. 


usage—(Optional) Display the state of licensed features. 


Required Privilege Level 
view 


SEE ALSO 


Adding New Licenses (CLI Procedure) | 64 


List of Sample Output 

show system license on page 89 

show system license installed on page 90 

show system license keys on page 90 

show system license usage on page 91 

show system license status logical-system all on page 91 


Output Fields 


Table 38 on page 89 lists the output fields for the show system license command. Output fields are listed 
in the approximate order in which they appear. 
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Table 38: show system license Output Fields 


Field Name 


Feature name 


Licenses used 


Licenses installed 


Licenses needed 


Expiry 


Logical system 
license status 


| Sample Output 


show system license 


Field Description 


Name assigned to the configured feature. You use this information to verify that all the features 


for which you installed licenses are present. 


Number of licenses used by the device. You use this information to verify that the number of 
licenses used matches the number configured. If a licensed feature is configured, the feature 


is considered used. 


Information about the installed license key: 


e License identifier—Identifier associated with a license key. 


e License version—Version of a license. The version indicates how the license is validated, 
the type of signature, and the signer of the license key. 


e Valid for device—Device that can use a license key. 


e Features—Feature associated with a license. 


Number of licenses required for features being used but not yet properly licensed. 


Time remaining in the grace period before a license is required for a feature being used. 


Displays whether a license is enabled for a logical system. 


user@host> show system license 


License usage: 











Licenses Licenses Licenses Expiry 

Feature name used installed needed 

av_key_kaspersky_engin il il 0 AOIEZ 033 S10) 
Ol SOO SOO) IIs 

wf_key_surfcontrol_cpa 0 i 0 ZO L2-0S'= 30) 
(OME STOO Sea) acisak 

dynamic-vpn 0 1 0 permanent 

ax411-wlan-ap 0 Zz 0 permanent 
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Licenses installed: 
License identifier: JUNOS301998 








License version: 2 
Valid for device: AG4909AA0080 
INSrane UES) € 
av_key_kaspersky_engin Kaspersky AV 
AVIL—O3=30 Ols0O200 TS — 2012-03-30 WilsOOs@0 LST 





date-based, 


License identifier: JUNOS302000 








License version: 2 


Valid for device: AG4909AA0080 


Peatures: 
wf_key_surfcontrol_cpa - Web Filtering 


Cacecoasccl, ZWLL-OS—30 WlsOOsvO USt — 20LZ-03-30 OLeEOOsOO St 


show system license installed 


user@host> show system license installed 


identifier: JUNOS301998 





Licens 


License version: 2 


Valid for device: AG4909AA0080 


Pestures: 


av_key_kaspersky_engin Kaspersky AV 
AVIIL-OS—30 WlLsOOsGO cSt = 2OL2-OS—3O0 O1eOOs0O ws 





date-based, 


identifier: JUNOS302000 





Licens 





License version: 2 
Valid for device: AG4909AA0080 


Peatlures: 


wf_key_surfcontrol_cpa - Web Filtering 
cerecoasecl, ZOill—-OS—30 OlsQOsOO usr = ZOIZ2-OS-—30 OlsOWscOO usa 


show system license keys 


user@host> show system license keys 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 


XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 


XXXXXX XXXXXX XXX 


show system license usage 


user@host> show system license usage 








Licenses Licenses 
Feature name used installed 
av_key_kaspersky_engin ab af 
OMEAO OHIO O Ma Sas 
wf_key_surfcontrol_cpa 0 Bl 
Oils@©OsO@Q ws 
dynamic-—vpn 0 il 
ax411-wlan-ap 0 2 
show system license status logical-system all 
user@host> show system license status logical-system all 
Logical system license status: 
logical system name license status 
root-logical-system enabled 
LSYSO enabled 
SNSil enabled 
sy s2 enabled 





Licenses 
needed 
0 
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Expiry 


ZOOS 50 


AOL2—O3—=30 


permanent 


permanent 


traceoptions (System License) 


Syntax 


traceoptions { 
file { 
filename; 
files number; 
match regular-expression; 
size maximum-file-size; 
(world-readable | no-world-readable); 


} 
flag flag; 
no-remote-trace; 


} 


Hierarchy Level 


[edit system license] 


Release Information 

Statement introduced in Junos OS Release 8.5 for SRX Series and vSRX. 

Statement introduced in Junos OS Release 14.1X53-D10 for EX Series and QFX Series. 
Statement introduced in Junos OS Release 15.1 for M Series, MX Series, and T Series. 


Description 


Set trace options for licenses. 


Options 


file—Configure the trace file information. 


filename—Name of the file to receive the output of the tracing operation. Enclose the name within 
quotation marks. All files are placed in the directory /var/log. By default, the name of the file is 
the name of the process being traced. 


files number—Maximum number of trace files. When a trace file named trace-file reaches its maximum 
size, it is renamed trace-file.O, then trace-file.1, and so on, until the maximum number of trace 
files is reached. Then the oldest trace file is overwritten. 


If you specify a maximum number of files, you also must specify a maximum file size with the size 
maximum file-size option. 

Range: 2 through 1000 files 

Default: 10 files 
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match regular-expression—Refine the output to include lines that contain the regular expression. 


size size—Maximum size of each trace file, in kilobytes (KB), megabytes (MB), or gigabytes (GB). If you 
specify a maximum file size, you also must specify a maximum number of trace files with the files 
number option. 


Range: 10 KB through 1 GB 
Default: 128 KB 


world-readable | no-world-readable—By default, log files can be accessed only by the user who 
configures the tracing operation. The world-readable option enables any user to read the file. To 
explicitly set the default behavior, use the no-world-readable option. 


flag flag—Specify which tracing operation to perform. To specify more than one tracing operation, include 
multiple flag statements. You can include the following flags. 


e all—Trace all operations. 
e config—Trace license configuration processing. 


e events—Trace licensing events and their processing. 


no-remote-trace—Disable the remote tracing. 


Required Privilege Level 
trace—To view this statement in the configuration. 
trace-control—To add this statement to the configuration. 
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request system license add 


Syntax 


request system license add (filename | terminal) 


Release Information 

Command introduced before Junos OS Release 7.4. 

Command introduced in Junos OS Release 9.0 for EX Series switches. 
Command introduced in Junos OS Release 9.5 for SRX Series devices. 
Command introduced in Junos OS Release 11.1 for the QFX Series. 

Added additional information section on XML RPC in Junos OS Release 17.4. 


Description 


Adding a license key to the Junos OS devices to activate the feature. 


Starting in Junos OS Release 18.3R1, the display xml rpc CLI option is supported for request system license 
add and request system license save commands while installing licenses on Juniper Networks devices. 


Options 


filename—License key from a file or URL. Specify the filename or the URL where the key is located. 


terminal—License key from the terminal. 


Additional Information 


The | display xml rpc filter returns “xml rpc equivalent of this command is not available,” the following RPC 
is supported for license installation: 


The following RPC is supported for license installation: 


<oe> 





<request-—license-add> 


<key-data> key </key-data> 





</request-—license-add> 


</rpe> 


Where key-data is the license key data. 


Koo> 





<request—license-add> 





<filename> key-file </filename> 





</request-—license-add> 


</rpe> 


Where source is the URL of the source license key file. 
Required Privilege Level 
maintenance 


List of Sample Output 
request system license add on page 95 


Output Fields 


When you enter this command, you are provided feedback on the status of your request. 


Sample Output 


request system license add 


user@host> request system license add terminal 


XXXXXXXXXX XXXXKXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
RKXAKK KXKKXX KKXKKX KRXKMKX KRKKKXM XXMKKX 
XXXXXK XKKMKK MXX 


XXXXXXXXXK: successfully added 





add license complete (no errors) 
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request system license save 


Syntax 


request system license save (filename | terminal) 


Release Information 

Command introduced before Junos OS Release 7.4. 

Command introduced in Junos OS Release 9.0 for EX Series switches. 
Command introduced in Junos OS Release 11.1 for the QFX Series. 
Command introduced in Junos OS Release 9.5 for SRX Series devices. 
Added additional information section on XML RPC in Junos OS Release 17.4. 


Description 


Save installed license keys to a file or URL. 


Starting in Junos OS Release 18.3R1, the display xml rpc CLI option is supported for request system license 
add and request system license save commands while installing licenses on Juniper Networks devices. 


Options 


filename—License key from a file or URL. Specify the filename or the URL where the key is located. 


terminal—License key from the terminal. 


Additional Information 


The following RPC is supported for saving installed license keys to a file or URL: 


<EOO> 





<request-—license-save> 


<filename>destination</filename> 





</request-license-save> 


</f TXSS 


Where destination is the URL of the destination license key file. 


Required Privilege Level 
maintenance 


List of Sample Output 
request system license save on page 97 


Output Fields 


When you enter this command, you are provided feedback on the status of your request. 


Sample Output 


request system license save 


user@host> request system license save ftp://user@host/license.conf 
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request system license update 


Syntax 


request system license update 


Release Information 
Command introduced in Junos OS Release 9.5. 


Description 


Starts autoupdating license keys from the license portal. 


e The request system license update command always uses the default Juniper license server: 
https://ae1.juniper.net/. 


e The request system license update command is supported only on SRX, vSRX, and QFX Series devices. 


The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, SRX Series, EX 
Series, NFX, vBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, JSA, SBR Carrier, Screen 
OS and so on) access the License Management System (LMS). 


Options 


trial—Immediately updates trial license keys from the license portal. 


Required Privilege Level 
maintenance 


List of Sample Output 
request system license update on page 98 
request system license update trial on page 99 


Output Fields 


When you enter this command, you are provided feedback on the status of your request. 


Sample Output 


request system license update 


user@host> request system license update 


Trying to update license keys from https://ael.juniper.net has been sent, use show 


system license to check status. 





request system license update trial 


user@host> request system license update trial 


Request to automatically update trial license keys from https://ael.juniper.net 





has been sent, use show system license to check status. 
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request system license delete 


Syntax 


request system license delete ( license-identifier | license-identifier-list [ licenseid001 licenseid002 licenseid003 | | all 


) 


Release Information 

Command introduced before Junos OS Release 7.4. 

Command introduced in Junos OS Release 9.0 for EX Series switches. 
Command introduced in Junos OS Release 11.1 for the QFX Series. 
Option license-identifier-list introduced in Junos OS Release 13.1. 


Description 
Delete a license key. You can choose to delete one license at a time, all licenses at once, or a list of license 
identifiers enclosed in brackets. 


Options 


license-identifier—Text string that uniquely identifies a license key. 


license-identifier-list [ licenseid001 licenseid002 licenseid003....|—Delete multiple license identifiers as a 
list enclosed in brackets. 


all—Delete all licenses on the device. 


Required Privilege Level 
maintenance 
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license 


Syntax 


license { 
autoupdate { 
url url <password password>; 
} 
keys { 
key key 
} 
renew { 
before-expiration number; 
interval interval-hours; 


} 
traceoptions (System License) { 
file { 
filename; 
files number; 
match regular-expression; 
size maximum-file-size; 
(world-readable | no-world-readable); 
} 
flag flag; 
no-remote-trace; 
} 


Hierarchy Level 


[edit system] 


Release Information 

Statement introduced in Junos OS Release 8.5 for SRX Series and vSRX. 

Options keys introduced in Junos OS Release 14.1X53-D10. 

Statement introduced in Junos OS Release 14.1X53-D10 for EX Series and QFX Series, with option keys 
included. 

Statement introduced in Junos OS Release 15.1 for M Series, MX Series, PTX Series, and T Series, with 
option keys included. 


Description 


Specify license information for the device. 


Options 


autoupdate—Autoupdate license keys from license servers. 


before-expiration number—License renewal lead time before expiration, in days. 


Range: O through 60 days 


interval interval-hours—License checking interval, in hours. 


Range: 1 through 336 hours 


keys key key—Configure one or more license keys. For example, 














[edit] 

user@devic set system license keys key "key_1" 
user@devic set system license keys key "key_2" 
user@devic set system license keys key "key_3" 
user@devic set system license keys key "key_4" 
user@device# commit 

commit complete 








renew—License renewal lead time and checking interval. 
url—URL of a license server. 


The remaining statements are explained separately. See CLI Explorer. 


Required Privilege Level 
system—To view this statement in the configuration. 
system-control—To add this statement to the configuration. 
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license-type 


Syntax 


license-type license deployment-scope [ deployments ]; 


Hierarchy Level 


[edit system extensions providersprovider-id] 


Release Information 
Statement introduced in Junos OS Release 11.1 for FX Series switches. 


Description 


Configure the license type and the scope of SDK application deployment. 


Options 


license—Type of license. Obtain correct value from the application’s provider. 


deployment—Scope of SDK application deployment. You can configure a set of deployments. Obtain correct 
value from the application’s provider. 


Required Privilege Level 
admin—To view this statement in the configuration. 
admin-control—To add this statement to the configuration. 
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CHAPTER 3 


Licenses for Routing Devices 


IN THIS CHAPTER 


Licenses for ACX Series | 104 
Licenses for PTX, MX, Mand T Series | 105 


t 
8 
@ Licenses for VMX | 137 
e 


License Configuration | 143 


| Licenses for ACX Series 


IN THIS SECTION 


@ = Software Features Requiring Licenses on ACX5448-D and ACX5448-M Routers | 104 


Software Features Requiring Licenses on ACX5448-D and ACX5448-M Routers 


Each feature license is tied to one software feature, and that license is valid for one device. Each license 
allows you to run the specified software features on a single device. 


Table 39 on page 105 lists the licensed features that you can purchase for ACX5448-D and ACX5448-M 
Series Universal Metro Routers. 
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Table 39: Junos OS Feature License Model Number for ACX5448-D and ACX5448-M Series Universal 
Metro Routers 


License 
Supported Device _ Licenses Software Feature Model Scale Model Number 
ACX5448-D and IP, MPLS, timing, CoS, E-OAM, | Advanced 32 L3VPN and | S-ACX-400G-A-1 
ACX5448-M telemetry, RFC2544 8 NG-MVPN 
S-ACX-400G-A-3 
S-ACX-400G-A-5 
ACX5448-D and All advanced software Premium Full-scale S-ACX-400G-P-1 


ACX5448-M subscription license features 


with full-scale. S-ACX-400G-P-3 


S-ACX-400G-P-5 


| Licenses for PTX, MX, M and T Series 
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Software Features That Require Licenses on M Series, MX Series, and T Series Routers 


Table 40 on page 106 lists the licenses you can purchase for each M Series, MX Series, and T Series software 
feature. Each license allows you to run the specified software feature on a single device. 
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The DHCP server functionality for Junos OS is part of the subscriber management feature. You must have 
the S-SA-FP, S-MX80-SA-FP or S-MX104-SA-FP license in order to enable the DHCP server. For service 
accounting, you must also have S-SSM-FP. 


For information about how to purchase a software license, contact your Juniper Networks sales 


representative at https://www.juniper.net/in/en/contact-us/. 


Table 40: Junos OS Feature License Model Number for M Series, MX Series, and T Series Routers 


Licensed Software Feature 


Generalized Multiprotocol Label 
Switching (GMPLS) Support on Junos OS 


IPvé Support on Junos OS 


Logical Router Support for Junos OS 


J-Flow accounting license for Adaptive 
Services (AS) PIC and Multiservices PIC 


Chassis license for Application Traffic 
Optimization service, policy enforcement 
and application statistics. This license 
includes S-Al and S-LDPF fucntionality 
and 1-year Signature Subscription License 


Software License for Passive Monitoring 
Flow Collector Application, supporting 
100 Kpps throughput; Chassis based 
license for Multiservices PIC 


License to use Compressed Real-Time 
Transport Protocol (CRTP) feature in AS 
PIC and Multiservices PIC 


Software License for Passive Monitoring 
DFC Application, supporting 100Kpps 
throughput; Chassis based license for 
Multiservices PIC 


Security Services license for AS PIC and 
Multiservices PIC 


Supported Devices 


M10i, M7i, M120, M160, M20, M320, M40e, 
T320, T640, and MX Series Routers 


M120, M160, M20, M320, M40e, T320, T640, 
and MX Series Routers 


M10i, M120, M160, M20, M320, M40e, M7i, 
T320, T640, and MX Series Routers 


M10i, M120, M160, M20, M320, M40e, M7i, 
T320, M10, M5, T640, and T1600 


MxX104, MX240, MX480, MX960, M Series, 
and T Series Routers 


M320, T640, T320, T1600 


M10i, M120, M160, M20, M320, M40e, M7i, 


T320, M10, M5, T640, and T1600 


M320, T640, T320, and T1600 


M10i, M7i, M5, M120, M160, M20, M320, 
M40e, T320, T640, M10, and T1600 


Model Number 


JS-GMPLS 


JS-IPv6é 


JS-LR 


S-ACCT 


S-ATO 


S-COLLECTOR-100K 


S-CRTP 


S-DFC-100K 


S-ES 
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Table 40: Junos OS Feature License Model Number for M Series, MX Series, and T Series Routers (continued) 


Licensed Software Feature 


Chassis license for IDP service, policy 
enforcement. This license includes S-Al 
and S-LDPF fucntionality and 1-year 
Signature Subscription License 


Junos-FIPS Software License 


Link Services Software License—up to 
1023 ML bundles per Chassis for 
Multiservices PIC and Multiservices 
Dense Port Concentrator (DPC) 


Link Services Software Ugrade 
License—from 255 to 1023 ML bundles 
per Chassis for Multiservices PIC and 
Multiservices DPC 


Link Services Software Ugrade 
License—from 64 to 255 ML bundles per 
Chassis for AS PIC, Multiservices PIC, and 
Multiservices DPC 


Link Services Software License—up to 
255 ML bundles per Chassis for AS PIC, 
Multiservices PIC, and Multiservices DPC 


Link Services Software License—up to 4 
ML bundles per Chassis for AS PIC, 
Multiservices PIC, and Multiservices DPC 


Link Services Software License—up to 64 
ML bundles per Chassis for AS PIC, MS 
PIC and MS DPC 


Link Services Software Upgrade 
License—from 4 to 64 ML bundles per 
Chassis for AS PIC, Multiservices PIC, and 
Multiservices DPC 


Supported Devices 


MX104, MX240, MX480, MX960, M Series, 


and T Series Routers 


M10i, M7i, M320, M40e, T320, and T640 


M5, M7i, M10, M10i, M20, M40e, M120, 


M320, T320, T640, T1600, MX240, MX480, 


and MX960 


M5, M7i, M10, M10i, M20, M40e, M120, 


M320, T320, T640, T1600, MX240, MX480, 


and MX960 


M5, M7i, M10, M10i, M20, M40e, M120, 


M320, T320, T640, T1600, MX240, MX480, 


and MX960 


M10, M7i, M5, M120, M20, M320, M40e, 


T320, T640, M10i, T1600, MX240, MX480, 


and MX960 


M10i, M120, M20, M320, M40e, M7i, T320, 
M10, M5, T640, T1600, MX240, MX480, and 


MX960 


M10, M7i, M5, M120, M20, M320, M40e, 


T320, T640, M10i, T1600, MX240, MX480, 


and MX960 


M5, M7i, M10, M10i, M20, M40e, M120, 


M320, T320, T640, T1600, MX240, MX480, 


and MX960 


Model Number 


S-IDP 


S-JUNOS-FIPS 


S-LSSL-1023 


S-LSSL-1023-UPG 


S-LSSL-255-UPG 


S-LSSL-256 


S-LSSL-4 


S-LSSL-64 


S-LSSL-64-UPG 
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Table 40: Junos OS Feature License Model Number for M Series, MX Series, and T Series Routers (continued) 


Licensed Software Feature 


Software License for Passive Monitoring 
Flow Monitor Application, supporting 1M 
flows. Chassis based license for 
Multiservices PIC 


Network Address Translation (NAT), FW 
license on AS PIC and Multiservices PIC: 
Multi-instance 


NAT, FW license on AS PIC and 
Multiservices PIC: Single-instance 


Software license for Packet trigger 
subscriber policy 


Subscriber Access Feature Pack License 
Scaling (128000) 


Subscriber Access Feature Pack License 
Scaling (32000) 


Subscriber Access Feature Pack License 
Scaling (4000) 


Subscriber Access Feature Pack License 
Scaling (64000) 


Subscriber Access Feature Pack License 
Scaling (8000) 


Subscriber Access Feature Pack License 
Scaling (96000) 


Subscriber Access Feature Pack license 


Stateful Failover for Services on AS PIC 


and Multiservices PIC: Multilink PPP 
(MLPPP) only 


Supported Devices 


M320, T640, T320, and T1600 


M10, M7i, M5, M120, M160, M20, M320, 
M40e, T320, T640, M10i, and T1600 


M10, M7i, M5, M120, M160, M20, M320, 


M40e, T320, T640, M10i, and T1600 


MX240, MX480, MX960, M120, and M320 


MX104, MX240, MX480, MX960, M120, and 


M320 


MX104, MX240, MX480, MX960, M120, and 
M320 


MX104, MX240, MX480, MX960, M120, 
M320, and MX80 


MX104, MX240, MX480, MX960, M120, and 
M320 


MX104, MX240, MX480, MX960, M120, 
M320, and MX80 


MX104, MX240, MX480, MX960, M120, and 
M320 


MX104, MX240, MX480, MX960, M120, and 
M320 


M10, M7i, M5, M120, M160, M20, M320, 
M40e, T320, T640, M10i, and T1600 


Model Number 


S-MONITOR-1M 


S-NAT-FW-MULTI 


S-NAT-FW-SINGLE 


S-PTSP 


S-SA-128K 


S-SA-32K 


S-SA-4K 


S-SA-64K 


S-SA-8K 


S-SA-96K 


S-SA-FP 


S-SERVICES-SFO 
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Table 40: Junos OS Feature License Model Number for M Series, MX Series, and T Series Routers (continued) 


Licensed Software Feature 


Subscriber Service Management Feature 
Packet License (RADIUS/SRC based 
Service Activation and Deactivation) 
Per-Service Accounting Features for 
Subscribers 


Subscriber Traffic Lawful Intercept 
Feature Pack License 


Software license for application aware 
traffic direct feature 


Software license for subscriber aware 
traffic direct feature 


Video Services Feature Pack license 


Port capacity enhancement Feature Pack 


License for MX5 routers 


Port capacity enhancement Feature Pack 
License for MX10 routers 


Port capacity enhancement Feature Pack 
License for MX40 routers 


Supported Devices 


MX104, MX240, MX480, MX960, M120, and 
M320 


MX240, MX480, MX960, M120, M320, and 


MxX80 


MX240, MX480, MX960, M120, and M320 


MX240, MX480, MX960, M120, and M320 


M120, M320, MX80, MX104, MX240, MX480, 


and MX960 


MX5 


MxX10 


MxX40 


Software Features That Require Licenses on MX Series Routers Only 


Model Number 


S-SSM-FP 


S-SSP-FP 


S-TFDIRECT-APP 


S-TFDIRECT-SUB 


S-VIDEO-FP 


mx5-to-mx10-upgrade 


mx10-to-mx40-upgrade 


mx40-to-mx80-upgrade 


Table 41 on page 111 lists the licenses you can purchase for each MX Series software feature. Each license 


allows you to run the specified software feature on a single device. 


e This is not a complete list of licenses. Contact your Juniper Networks representative for license 


information. 


e License is not required to use NAT feature on MX150, MX204, and MX10003 routers. 


For information about how to purchase a software license, contact your Juniper Networks sales 


representative at https://www.juniper.net/in/en/contact-us/. 
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The DHCP server functionality for Junos OS is part of the subscriber management feature. You must have 
the S-SA-FP, S-MX80-SA-FP or S-MX104-SA-FP license in order to enable the DHCP server. For service 
accounting, you must also have S-SSM-FP. 


Starting in Junos OS Release 16.1R1, after the completion of the 30 day grace period, DHCP bindings on 
MX series devices are limited to 10. This counts against broadband scale licenses S-MX104-SA-FP and 
S-SA-4K. 


Licensing details for DHCP Relay Configurations—lf processing dhcp-relay relay-option-82 is not required, 
then configure the forward-only statement under the [edit forwarding-options dhcp-relay relay-option 
(default-action | equals | starts-with)] hierarchy-level instead of configuring dhcp-relay directly. The 
forward-only DHCP Relay configurations do not require the S-SA-FP / S-MX80-SA-FP / S-MX104-SA-FP 
license to be installed. Also, configuring forward-only DHCP Relay assumes that the peer DHCP server is 
capable of returning relay-option-82 attributes originally sent via the DHCP Relay. 


Subscriber Access Feature Pack (SKUs - S-SA-FP, S-MX80-SA-FP, and S-MX104-SA) 


e Per subscriber RADIUS accounting (time and volume based) - require SSM for per service accounting 
e RADIUS-based authentication and authorization 
e Subscriber configuration through client profiles at subscriber login 


e You require the S-SSM-FP SKU to change variable values within client profiles through radius grant or 
access accept, COA or RID, and SRC 


e RADIUS and SDX based address pool management 
e Static and dynamic IP management 
e Dynamic auto-sensed VLANs 


e Video edge services (S-SA-FP SKU is the superset and the S-VIDEO-FP SKU is not required) 


Subscriber Services Management Feature Pack (SKUs - S-SSM-FP, S-MX80-SSM-FP, and 
S-MX104-SSM-FP) 


e Per service RADIUS accounting (time and volume based) 


e Activate or deactivate service profiles at subscriber login through the RADIUS grants or access accepts 
(services activation and deactivation VSAs) or changes to existing sessions through the RADIUS COA 
or RID, or SRC 


e Parameterization of service profiles 


e ANCP QoS adjustment based on synchronization rate through ANCP 
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Table 41: Junos OS Feature License Model Number for MX Series Routers 


Licensed Software Feature 


License to use IDS for DDoS 
mitigation on services card NPU. 


The license is per NPU for MS-MIC 
and MS-MPC service cards. 


Upgrade license—from 
MX80-10G-ADV to MX80-40G-ADV 


Upgrade license—from MX80-10G 
to MX80-40G 


Upgrade license—from 
MX80-40G-ADV to full MX80 


Upgrade license—from MX80-40G 
to full MX80 


Upgrade license--from 
MX80-5G-ADV to MX80-10G-ADV 


Upgrade license—from MX80-5G to 
MX80-10G 


Upgrade license to activate 2x10GE 
P2&3 


Upgrade license to activate 2X10GE 
PO&1 


Upgrade license to activate 4X10GE 
fixed ports on MX104 


License to support per VLAN queuing 
on MxX8s0 


License to support per VLAN queuing 
on MxX104 


Supported Devices 


MS-MPC service card is supported 
on MX240, MX480, MX960, 
MX2008, MX2010, and MX2020 


MS-MIC service card is supported on 


MX5 through MX104, MX240, 


MX480, MX960, MX2008, MX2010, 


and MxX2020 


MxX80 


MX80 


MxX80 


MxX80 


MX80 


MxX80 


MxX104 


MxX104 


MxX104 


MX5, MX10, MX40, and MX80 


MxX104 


Model Number 


S-IDS-NPU 


MX80-10G40G-UPG-ADV-B 


MX80-10G40G-UPG-B 


MX80-40G-UPG-ADV-B 


MX80-40G-UPG-B 


MX80-5G10G-UPG-ADV-B 


MX80-5G10G-UPG-B 


S-MX104-ADD-2X10GE 


S-MX104-UPG-2X10GE 


S-MX104-UPG-4X10GE 


S-MX80-Q 


S-MX104-Q 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Chassis-based software license for 
inline J-Flow monitoring on MX5, 
MX10, M40, MX80, and MX104 
Series routers 


Chassis-based software license for 
inline J-Flow monitoring on MX240 
routers 


Chassis-based software license for 
inline J-Flow monitoring on MX480 
routers 


Chassis-based software license for 
inline J-Flow monitoring on MX960 
routers 


Chassis-based software license for 
inline J-Flow monitoring on MX2008 
routers 


Chassis-based software license for 
inline J-Flow monitoring on MX2010 
routers 


Chassis-based software license for 
inline J-Flow monitoring on MX2020 
routers 


Flow monitoring and accounting 
features using J-Flow service on any 
Modular Port Concentrator (MPC) or 
MS-DPC 


Software License for in-line J-Flow 
service on Trio MPCs 


Flow monitoring and accounting 
features using J-Flow service on any 
MPC limited to 10G of total JFLOW 
traffic 


Supported Devices 


MX5, MX10, MX40, MX80, and 
MxX104 


MX240 


MxX480 


MX960 


MX2008 


MX2010 


MX2020 


MX240, MX480, and MX960 


MX240, MX480, MX960, MX2008, 
MX2010, and MX2020 


MX80 


Model Number 


S-JFLOW-CH-MX5-104 


S-JFLOW-CH-MX240 


S-JFLOW-CH-MX480 


S-JFLOW-CH-MX960 


S-JFLOW-CH-MX2008 


S-JFLOW-CH-MX2010 


S-JFLOW-CH-MX2020 


S-ACCT-JFLOW-CHASSIS 


S-ACCT-JFLOW-IN 


S-ACCT-JFLOW-IN-10G 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Flow monitoring and accounting 
features using J-Flow service on any 
MPC limited to 10G of total JFLOW 
traffic 


Flow monitoring and accounting 
features using J-Flow service on any 
MPC limited to 5G of total JFLOW 
traffic 


Security services (IPsec, VPN and 
group VPN) license based ona single 
NPU for MS-MIC, MS-DPC or 
MS-MPC 


2000 IKE sessions on MS-DPC; 
Chassis based, limited to 6000 per 
Chassis 


4000 IKE sessions on MS-DPC; 
Chassis based, limited to 6000 per 
Chassis 


Upgrade from 2000 IKE sessions to 
4000 IKE sessions on MS-DPC; 
Chassis based, limited to 6000 per 
Chassis 


6000 IKE sessions on MS-DPC; 
Chassis based, limited to 6000 per 
Chassis 


Upgrade from 4000 IKE sessions to 
6000 IKE Sessions on MS-DPC; 
Chassis based, limited to 6000 per 
Chassis 


License to run stateful firewall on one 
NPU per MS-MIC, MS-DPC or 
MS-MPC 


Supported Devices 


MxX80 


MxX80 


MX Series Routers 


MX240, MX480, and MX960 


MX240, MX480, and MX960 


MX240, MX480, and MX960 


MX240, MX480, and MX960 


MX240, MX480, and MX960 


MX Series Routers 


Model Number 


S-ACCT-JFLOW-IN-10G-UPG 


S-ACCT-JFLOW-IN-5G 


S-ES-NPU 


S-ES-2K 


S-ES-4K 


S-ES-4K-UPG 


S-ES-6K 


S-ES-6K-UPG 


S-FW-NPU 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


License to support DS3 
Channelization (down to DSO) on 
each Modular Interface Card (MIC) 
for MIC-3D-8DS3-E3; also requires 
license S-MX80-Q when used on the 
MX80 platform 


License to support full-scale Layer 3 
routes and Layer 3 VPN 


License to support 256K routes 


License to support scaling Layer 3 
and VPN routes to 1 million or more 
entries on MX104 platforms 


License to support full-scale Layer 3 
routes and Layer 3 VPN on each slot 
for MPC-3D-16XGE-SFPP 


License to support full-scale Layer 3 
routes and Layer 3 VPN on each slot 
for port queuing MPCs 


License to support Precision Timing 
Protocol (PTP) 


License to support full-scale Layer 3 
routes and Layer 3 VPN on each slot 
for hierarchical quality of service 
(HQoS) MPCs 


Subscriber Management Feature 
Pack License 


Supported Devices 
MX5, MX10, MX40, MX80, MX104, 


MX240, MX480, MX960, MX2010, 
and MxX2020 


MX5, MX10, MX40, and MX80 


MxX104 


MxX104 


MX240, MX480, MX960, MX2010, 
and MxX2020 


MX240, MX480, MX960, MX2010, 
and MxX2020 


MX204, MX240, MX480, MX960, 


MX10003, MX10008, and MX10016 


MX240, MX480, MX960, MX2010, 
and MxX2020 


MX5, MX10, MX40, and MX80 


MxX104 


Model Number 


S-MIC-3D-8CHDS3 


S-MX80-ADV-R 


S-MX104-ADV-R1 


S-MX104-ADV-R2 


S-MPC-3D-16XGE-ADV-R 


S-MPC-3D-PQ-ADV-R 


S-MPC-3D-PTP 


S-MPC-3D-VQ-ADV-R 


S-MX80-SA-FP 


(Includes S-LNS-IN) 


S-MX104-SA-FP 


(Includes S-LNS-IN) 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Subscriber Access Feature Pack 
License 


Subscriber Service Management 
Feature Packet License—RADIUS and 
SRC-based service activation and 
deactivation per-service accounting 
features 


Upgrade to Traffic Direct Advanced 
(per MS-DPC) 


License to run one instance of the 
NAT software on one NPU per 
MS-DPC 


License to support inline NAT 
software on MX5, MX10, MX40, 
MX80, MX104 


License to run one instance of the 
NAT software on one NPU per 
MS-MIC, MS-DPC, or MS-MPC 


License to run NAT using any MPC 
in an MX Chassis 


Subscriber Access Feature Pack 
License Scaling (4000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 4000 through 8000 subscribers 


Supported Devices 

MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 

MX5, MX10, MX40, and MX80 
MxX104 

MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 


MX10003 


MX960 


MX240, MX480, and MX960 


MX5, MX10, MX40, MX80, and 
MxX104 


MX Series Routers 


MX240, MX480, and MX960 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


Model Number 


S-SA-FP 


S-MX80-SSM-FP 


S-MX104-SSM-FP 


S-SSM-FP 


S-MX-TD-UPG 


S-NAT 


S-NAT-IN-MX5-104 (Replaces 
S-NAT-IN-MX40-MX80 and 
S-NAT-IN-MX5-MX10) 


S-NAT-NPU (Replaces 


S-NAT-IN-MX40-MX80-UPG) 


S-NAT-IN-MX-CHASSIS 


S-SA-4K 


S-SA-UP-8K 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Subscriber Access Feature Pack 
License Scaling (8000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 8000 through 16,000 
subscribers 


Subscriber Access Feature Pack 
License Scaling (16,000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 16,000 through 32,000 
subscribers 


Subscriber Access Feature Pack 
License Scaling (32,000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 32,000 through 64,000 
subscribers 


Subscriber Access Feature Pack 
License Scaling (64,000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 64,000 through 96,000 
subscribers 


Supported Devices 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MxX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


Model Number 


S-SA-8K 


S-SA-UP-16K 


S-SA-16K 


S-SA-UP-32K 


S-SA-32K 


S-SA-UP-64K 


S-SA-64K 


S-SA-UP-96K 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Subscriber Access Feature Pack 
License Scaling (96,000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 96,000 through 128,000 
subscribers 


Subscriber Access Feature Pack 
License Scaling (128,000) 


Upgrade license—Subscriber Access 
Feature Pack scaling license upgrade 
from 128,000 through 256,000 
subscribers 


Subscriber Access Feature Pack 
License Scaling (256,000) 


Software License for Secure Flow 
Mirroring Service (FlowTap) (does 
not require MS-DPC) 


License to run one instance of the 
SFW and software on a MS-DPC 


Software license for one member of 
an MX Virtual Chassis 


Upgrade license—from MX10 to 
equivalent of MX40; allows 
additional 2x10G fixed ports to be 
used on the MX10 router 


Supported Devices 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 


MX5, MX10, MX40, MX80, MX104, 
MX204, MX240, MX480, MX960, 
MX2008, MX2010, MX2020, and 
MX10003 

MX80, MX104, MX240, MX480, and 
MX960 

MX960, MX480, and MX240 
MX240, MX480, MX960, MX2008, 


MX2010, MX2020, and MX10003 


MX10-T 


Model Number 


S-SA-96K 


S-SA-UP-128K 


S-SA-128K 


S-SA-UP-256K 


S-SA-256K 


S-SFM-FLOWTAP-IN 


S-SFW 


S-VCR 


MX10-40-UPG 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature 


Upgrade license—from MX10 to 
equivalent of MX80; allows 
additional 4x10G fixed ports to be 
used on the MX10 router 


Upgrade license—from MX40 to 
equivalent of MX80; allows 
additional 2x10G fixed ports to be 
used on the MX40 router 


Upgrade license—from MX5 to 
equivalent of MX10; allows second 
MIC slot to be used on the MX5 
router 


Upgrade license—from MX5 to 
equivalent of MX40; allows second 
MIC slot and 2x10G fixed ports to 
be used on the MX5 router 


Upgrade license—from MX5 to 
equivalent of MX80. Allows second 
MIC slot and 4x10G fixed ports to 
be used on the MX5 router 


License to use MX as Controller or 
Aggregation device for Junos Fusion. 
One license per MX is needed. 


License to run any supported 
EX4300 model as a satellite device 
in Junos Fusion mode. One license 
per EX4300 is needed 


License to run any supported 
QFX5100 model as a satellite device 
in Junos Fusion mode. One license 
per QFX5100 is needed 


Supported Devices 


MX10-T 


MX40-T 


MX5-T 


MX5-T 


MX5-T 


MX5, MX10, MX40, MX80, MX104, 
MX240, MX480, MX960, MX2010, 
and MxX2020 


MX204, MX240, MX480, MX960, 
MX2010, MX2020, and MX10003 


MX204, MX240, MX480, MX960, 
MX2010, MX2020, and MX10003 


Model Number 


MX10-80-UPG 


MX40-80-UPG 


MX5-10-UPG 


MX5-40-UPG 


MX5-80-UPG 


S-MX-AD-FUSION-LIC 


S-MX-SAT-EX4300 


S-MX-SAT-QFX5100 
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Table 41: Junos OS Feature License Model Number for MX Series Routers (continued) 


Licensed Software Feature Supported Devices Model Number 


Subscriber Traffic Lawful Intercept MX204, MX240, MX480, MX960, S-SSP-FP 
Feature Pack License MX2008, MX2010, MX2020, and 


MX10003 
Software License for FlowTapLite 


Junos BB Policy Enforcement MX204, MX240, MX480, MX960, S-BB-NASREQ 
Feature License for dynamic MX2008, MX2010, MX2020, and 

subscriber authentication and MX10003 

authorization using NASREQ (1 per 

chassis) 


Junos BB Policy Enforcement feature | MX204, MX240, MX480, MX960, S-BB-GX 
license for PCRF communications MX2008, MX2010, MX2020, and 

using 3GPP Gx and Gx+ (1 per MX10003 

chassis) 


Junos BB Policy Enforcement feature | MX204, MX240, MX480, MX960, S-BB-GY 
license for online charging using MX2008, MX2010, MX2020, and 
3GPP Gy interface (1 per chassis) MxX10003 


Software License for Inline L2TPLNS | MX204, MX240, MX480, MX960, S-LNS-IN 
(MX204, MX240/480/960, MX2008, _MX2008, MX2010, MX2020, and 
MX2010/2020) (1 per chassis) MxX10003 


Software Features That Require Licenses on M Series Routers Only 


Table 42 on page 119 lists the licenses you can purchase for each M Series software feature. Each license 
allows you to run the specified software feature on a single device. 


For information about how to purchase a software license, contact your Juniper Networks sales 
representative at https://www.juniper.net/in/en/contact-us/. 


Table 42: Junos OS Feature License Model Number for M Series Routers 


Licensed Software Feature Supported Devices Model Number 


J-Flow accounting license on Integrated Adaptive Services M7i S-ACCT-BB 
Module (ASM) and Integrated Multiservices Module 


Security Services license on ASM and Integrated Multiservices = M7i S-ES-BB 
Module 
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Table 42: Junos OS Feature License Model Number for M Series Routers (continued) 


Licensed Software Feature 


Layer 2 Tunneling Protocol (L2TP) L2TP Network Server (LNS) 
license for 16000 sessions on Multiservices PIC 


L2TP LNS license Upgrade—from 8000 to 16000 sessions on 
Multiservices PIC 


L2TP LNS license for 2000 sessions on AS PIC or Integrated 
Adaptive Services Module and Multiservices PIC 


L2TP LNS license for 4000 sessions on AS PIC or Integrated 
Adaptive Services Module and Multiservices PIC 


L2TP LNS license Upgrade—from 2000 to 4000 sessions on 
AS PIC or Integrated Adaptive Services Module and 
Multiservices PIC 


L2TP LNS license for 8000 sessions on Multiservices PIC 


L2TP LNS license Upgrade—from 4000 to 8000 sessions on 
AS PIC and Multiservices PIC 


Link services software license on integrated ASM and 
Integrated Multi Services Module—up to 4 ML bundles 


NAT, FW license on Integrated ASM and Integrated Multi 
Services Module: Multi instance 


NAT, FW license on Integrated ASM and Integrated Multi 
Services Module: Single instance 


Tunnel services software license for AS PIC and Multiservices 
PIC (chassis license) 


License Modes for PTX Series Routers 


Supported Devices 


M120 


M120 


M7i, M10i, and M120 


M7i, M10i, and M120 


M7i, M10i, and M120 


M7i, M10i, and M120 


M7i, M10i, and M120 


M7i 


M7i 


M7i 


M7i and M10i 


Model Number 


S-LNS-16K 


S-LNS-16K-UPG 


S-LNS-2K 


S-LNS-4K 


S-LNS-4K-UPG 


S-LNS-8K 


S-LNS-8K-UPG 


S-LSSL-BB 


S-NAT-FW-MULTI-BB 


S-NAT-FW-SINGLE-BB 


S-TUNNEL 


PTX Series routers are available in two license variants: IR and R. Depending on the license purchased, the 


router offers full IP or LSR. 


Table 43 on page 121 describes the two license variants for the PTX1000. 
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Table 43: License Variants for the PTX1000 


License Description Scale Restictions 


IR Scaled up LSR and peering Up to 1 million routes in the 


forwarding information base (FIB) 


Up to 6 million routes in the routing 


information base (RIB) 


Up to 256 routing instances of the 
virtual routing and forwarding (VRF) 
instance type 


e Up to 128 thousand LSPs 
R Full IP core None 
The license-mode statement is only supported on the PTX3000 and PTX5000 Series routers with 
third-generation FPCs. 
Table 44 on page 121 describes the two license variants for the PTX3000 and PTX5000. 
Table 44: License Variants for the PTX3000 and PTX5000 FPCs 


License Description Scale Restrictions 


IR Scaled up LSR and peering Up to 2 million routes in the 


forwarding information base (FIB) 


Up to 6 million routes in the routing 


information base (RIB) 


Up to 256 routing instances of the 
virtual routing and forwarding (VRF) 
instance type 


Up to 128 thousand LSPs 


R Full IP core None 


For the PTX3000 and PTX5000, If you purchase two FPCs: one with an IR license and one with an R 
license. After the FPCs are installed on a router, both FPCs appear identical. To distinguish between an 
FPC with an IR license and an FPC with an R license after the FPC is installed on the router, you must 
configure the license mode based on the license purchased. For instance, if you purchased an FPC with 
the IR license, you must configure the license mode for that FPC as IR. The license mode settings are set 
specific to each FPC slot. If the FPC is installed in a different slot, or moved to another device, the license 
mode settings must be reconfigured on the new slot or device. Also, the license mode settings previously 
configured must be deleted. 


122 


The license mode settings are used only to provide information. You cannot set or alter the license of the 
FPC by configuring the license mode. 


To view the current license mode settings, from the configuration mode, use the show chassis fpc command. 
To view the current license mode settings, from the operational mode, use the show chassis hardware 
extensive command. To delete the existing license mode settings, use the delete chassis fpc command. 
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License Modes for Enhanced MPCs Overview 


Enhanced MPCs are available in three license variants. Before Junos OS Release 16.1, there were two 
variants: infrastructure routing (IR) and routing (R). Starting in Junos OS Release 16.1, there is also a base 
variant, making a total of three licence variants. All variants support an identical feature set, but with a 
few scale differences.Table 45 on page 123 describes the three license variants. 


Table 45: License Variants for MPCs 


License How to Identify Description 


base No special suffix in the license name. | e All Layer 2, Layer 2.5, and Layer 3 features. 


Up to 32 Layer 3 routing instances of the 


virtual routing and forwarding (VRF) instance. 
The VRF support includes Layer 3 VPN 
(L8VPN). 


Up to 2 million routes in the forwarding 


information base (FIB), provided there is 
hardware support. (FIB is also known as 
forwarding table.) 


Up to 6 million routes in the routing 
information base (RIB), also known as routing 
table. 


IR -IR suffix in the license name. All Layer 2, Layer 2.5, and Layer 3 features. 


Up to 32 Layer 3 routing instances of the 


virtual routing and forwarding (VRF) instance. 
The VRF support includes Layer 3 VPN 
(L8VPN). 


R -R suffix in the license name. Full-scale Layer 2, Layer 2.5, and Layer 3 features. 
Scale is determined by the hardware capabilities. 


Suppose you have purchased two MPC4Es: one with IR license and one with R license. After the MPCs 
are installed on a router, both MPCs appear identical. To distinguish between an MPC with an IR license 
and an MPC with an R license after the MPC is installed on the router, you must configure the license 
mode based on the license purchased. For instance, if you have purchased an MPC with the IR license, 
you must configure the license mode for that MPC as IR. The license mode settings are set specific to each 
MPC slot. If the MPC is installed in a different slot, or moved to another device, the license mode settings 
must be reconfigured on the new slot or device. Also, the license mode settings previously configured 
must be deleted. 


The license mode settings are used only to provide information. You cannot set or alter the license of the 
MPC by configuring the license mode. 


To view the current license mode settings on an MPC, from the configuration mode, use the show chassis 


fpc command. To view the current license mode settings on an MPC, from the operational mode, use the 
show chassis hardware extensive command. To delete the existing license mode settings on an MPC, use 
the delete chassis fpc command. 


Configuring the License Mode for Specific Enhanced MPCs on MX Series Routers 


Starting with Junos OS Release 14.2, you can set the license mode for enhanced MPCs such as MPC4E, 
MPC5E, and MPCé. Configuring the license mode enables you to distinguish between an MPC with an IR 
license and an MPC with an R license after the MPC is installed on the router. An MPC with an R license 
supports all the Layer 2, Layer 2.5, and Layer 3 features. An MPC with an IR license offers partial support 
for these features. For more information about the license variants, see “License Modes for Enhanced 
MPCs Overview” on page 123 


The license mode settings are used only to provide information. You cannot set or alter the license of the 
MPC when you configure the license mode. 


Before you configure the license mode of the MPC, verify the license of the MPC. You will need this 
information do configure the license mode. 


Do not try to set the license mode while the card is rebooting or the following error message will appear: 
Card not online or TRIO/DPC based. 


To configure the license mode for MPCs on MX Series routers: 


1. Configure the license mode for the MPC in a specified MPC slot. 


If the MPC has an IR license, configure the license mode as IR. If the MPC has an R license, configure 
the license mode of the MPC as R. 


[edit] 
user@host# set chassis fpc slot-number ir-mode ir-mode 
2. In configuration mode, verify the configuration, for example: 
[edit] 
user@host# show chassis 


foc 1 { 
ir-mode IR; 


3. After verifying the license mode, commit the changes by using the commit statement. 


[edit] 
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user@host# commit 


Example: Configuring the License Mode for MPC5E 


IN THIS SECTION 


Requirements | 125 
Overview | 125 
Configuration | 126 


Verification | 128 


This example describes how to configure the license mode for MPC5E on the MX480 router. It also 
describes how to remove the license mode settings and reconfigure the license mode settings on a new 
slot. 

Requirements 


This example uses the following hardware and software components: 


e Junos OS Release 14.2 or later for MX Series routers 


e Asingle MX480 router with MPC5E with R license 


Overview 


Configuring the license mode for an MPC enables you to distinguish between an MPC with an IR license 
and an MPC with an R license after the MPC is installed on the router. 


The license mode settings are used only to provide information. You cannot set or alter the license of the 
MPC when you configure the license mode. 


The license mode settings are set specific to each MPC slot. If the MPC is installed in a different slot, or 
moved to another device, the license mode settings must be reconfigured on the new slot or device. Also, 
the license mode settings configured previously must be removed. You can view the license mode settings 
from both configuration mode and operational mode. 


Topology 


In this example, an MPCSE is installed in slot 4 of an MX480 router and has an R license. The R license 
indicates that all Layer 2, Layer 2.5, and Layer 3 features are supported on the MPC. You first configure 
the license mode of the MPC5E in slot 4 to R. After configuring the license mode, you can verify the license 
mode settings. You then install the MPC5E in slot 2 of the same router. License mode settings are set 
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specific to each MPC slot. Therefore, the license mode setting must be reconfigured. After you move the 
MPC5E, delete the license mode setting on slot 4 and then reconfigure the license mode setting on slot 
2. 


Configuration 


IN THIS SECTION 


@ Configuring the License Mode for MPC5E in Slot 4 | 126 
@ Deleting the License Mode for MPC5E in Slot 4 | 127 
@ Configuring the License Mode for MPC5E in Slot 2 | 127 


To configure the license mode for the MPC5E according to the topology specified in the overview section, 
perform these tasks: 


Configuring the License Mode for MPC5E in Slot 4 


Step-by-Step Procedure 
To configure the license mode for the MPC5E in slot 4: 


1. Configure the license mode R for the MPC5E in slot 4: 


[edit] 
user@host# set chassis fpc 4 ir-mode R 


2. In configuration mode, verify the configuration. 


user@host# show chassis fpc 4 
pic Of 
power off; 


} 
pic 1{ 
power off; 


} 


ir-mode R; 


3. After verifying the license mode, commit the changes by using the commit statement. 


[edit] 
user@host# commit 
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Deleting the License Mode for MPC5E in Slot 4 


Step-by-Step Procedure 
To delete the license mode R for the MPC5E in slot 4: 


1. Delete the license mode for the MPC5E. 


[edit] 
user@host# delete chassis fpc 4 ir-mode R 


2. In configuration mode, verify the configuration. 


user@host# show chassis fpc 4 
pic O { 
power off; 
} 
pic 1 { 
power off; 


3. After verifying the license mode, commit the changes by using the commit statement. 


[edit] 
user@host# commit 


Configuring the License Mode for MPC5E in Slot 2 


Step-by-Step Procedure 
To configure the license mode for the MPC5E in slot 2: 


1. Configure the license mode R for the MPC5E. 


[edit] 
user@host# set chassis fpc 2 ir-mode R 


2. In configuration mode, verify the configuration. 


user@host# show chassis fpc 2 
pic Of 
power off; 
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pic 1{ 


power off; 


} 


ir-mode R; 
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3. After verifying the license mode, commit the changes by using the commit statement. 


[edit] 


user@host# commit 


Verification 


IN THIS SECTION 


@ Verifying That License Mode Is Configured for MPC5E in Slot 4 | 128 


@ ~~ Verifying That the Configured License Mode Is Deleted | 129 


@ Verifying That the License Mode Is Configured for MPC5E in Slot 2 | 130 


To confirm that you have accurately configured the license mode settings on MPC5E, perform these tasks: 


Verifying That License Mode Is Configured for MPC5E in Slot 4 


Purpose 


To verify that license mode R is configured for the MPC5E in slot 4. 


Action 


From operational mode, enter the show chassis hardware extensive command. 


user@host> show chassis hardware extensive 


FPC 4 

VecCeme oder 
P/N: 
Assembly ID: 
Date: 


Version: 


ID: MPC5E 3D Q 24XGE+6XLGE 





REV 30 
0x7£b0 
750-045715 
Ox0b8a 
O8—27=201LS 
REV 30 








750-045715 CABM2612 





EEPROM Version: 
SANS 











Assembly Version: 


Assembly Flags: 
CLEI Code: 

















Board Information Record: 


FRU Model Number: 


0x02 


MPC5!I 





CABM2612 


OS 
0x00 


0 





PRO 














E 3D Q 24XGE+6XLGE 





OXCLET 








INO) 


O-ASSI 





EMBLY 


Address 


0x00: 


I2C Hex Data: 


Address 
Address 
Address 
Address 
Address 
Address 
Address 
Address 


0x00: 
OxahOE 
O20 
Oxs0r 
0x40: 
0x50: 
0x60: 
OsaiOs 


R/IR Mode: R 


Meaning 


igse 


Wae 
00 
53 
dd 
ite 
D2 
00 
i616 


02 fe 
00 00 
4e 20 
ABE 3638 


io) 1S) 


lu) 


FE 54 4f 
0 00 00 
E i1e CA 


ny SS Tay Ie DS OS 
t Hh 





tere 


Ob 
SH 
43 
ise 
O1 
2d 
00 
IEE 


1EiE 





un) 


IEI2 4616 2636, 3e3e GEIe 


Ol te 52 45 56 
30 Zel 30 34 35 


[INa2Z ds 2536 sil 


iE 121 GEM IE ENE 
52 4£ 54 4£ 58 


lL 53 53 45 4d 42 


Ail SO SO wz sie 
SEIE GEJE G16 GE ie Ie 


License mode R is configured for the MPC5E in slot 4. 


Verifying That the Configured License Mode Is Deleted 


Purpose 


To verify that the configured license mode is deleted. 


Action 
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From operational mode, enter the show chassis hardware extensive command. 


user@host> show chassis hardware extensive 


FPC 4 


Jedec Code: 


P/N: 
Assembly 
Daiecr 
Version: 
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Meaning 


The license mode setting has been removed for the MPC5E in slot 4. 


Verifying That the License Mode Is Configured for MPC5E in Slot 2 


Purpose 


To verify that license mode R is configured for the MPC5E in slot 2. 


Action 


From operational mode, enter the show chassis hardware extensive command. 


user@host> show chassis hardware extensive 
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R/IR Mode: R 


Meaning 


License mode R is configured for the MPC5E in slot 2. 
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Junos OS Feature License Keys 


Some Junos OS software features require a license to be activated. To enable each licensed feature, you 
must purchase, install, manage, and verify a license key that corresponds to the licensed feature. 


Release-Tied License Keys and Upgrade Licenses on MX Series Routers 


The Junos OS licensing infrastructure currently associates a license feature with attributes such as date, 
platform, and validity. In addition to these attributes, for MX Series routers running Junos OS Release 12.2 
and later, a licensed feature can be associated with a release number at the time of generating the license 
key. This type of release-tied license key is used to validate a particular licensed feature while attempting 
a software upgrade. The upgrade process aborts if the release number in the license key is earlier than the 
Junos OS release number to which the system is being upgraded. 


Additionally, an upgrade license key can be generated for a release-tied licensed feature. An upgrade 
license key is used for carrying forward a capacity license to the upgrade release. Although an upgrade 
license might be an acceptable license on the current release, it does not add to the existing capacity limit. 
The capacity added in the upgrade license key is valid for the upgrade software release only. 


The release number embedded in the license key indicates the maximum release number up to which 
Junos OS can be upgraded. 


As an example, assume that your system is running Junos OS Release 12.2 and is using the scale-subscriber 
licensed feature with a later release-tied upgrade license key installed. If you request a software upgrade 
to the later release of Junos OS, the software upgrade operation fails and the following error message is 
displayed: 





mgd: error: No valid upgrade license found for feature 'scale-subscriber'. 
Aborting Software upgrade. 
Validation failed 


In this example, to successfully upgrade to the later release of Junos OS, the release number included in 
the upgrade license key should be greater than or equal to the later release number. Also, you can perform 
software upgrades up to the previous release without any additional license keys to retain the existing 
scale limit. 


When you install a release-tied license, the following apply: 


e You can purchase an upgrade capacity license only if a base capacity license for the same scale-tier has 
already been generated or purchased. 


e You cannot install an upgrade license if the capacity does not match any of the existing base capacity 
licenses on the system. 


e The license installation fails when you install a lower release number license key on a higher software 
release number. 


e Arelease-tied license can be installed on a Junos OS release number that is lower than or equal to the 
release number included in the license key. For example, a 12.2 license key is valid on Junos OS Release 
12.1. 


e An upgrade license is valid only on the target release number specified in the license key, but can be 
installed on an earlier Junos OS release. For example, a 4 K scale-tier upgrade license for Junos OS 
Release 12.2 can be installed on an earlier release, and the installed count of licenses remains unaltered. 


e Release-tied licenses of the previous release are not deleted on upgrading Junos OS to a newer release 
version. 


Licensable Ports on MX5, MX10, and MX40 Routers 


Starting with Junos OS Release 12.2, license keys are available to enhance the port capacity on MX5, 
MX10, and MX40 routers up to the port capacity of an MX80 router. The MX5, MX10, and MX40 routers 
are derived from the modular MX80 chassis with similar slot and port assignments, and provide all 
functionality available on an MX80 router, but at a lower capacity. Restricting port capacity is achieved 
by making a set of MIC slots and ports licensable. MICs without a license are locked, and are unlocked or 
made usable by installing appropriate upgrade licenses. 


The base capacity of a router is identified by the Ideeprom assembly ID (I2C ID), which defines the board 
type. However, the Junos OS licensing infrastructure allows the use of restricted ports without a license 
for a grace period of 30 days. After the grace period expires, the router reverts back to the base capacity 
if no upgrade license is purchased and installed for the locked ports. The I2C ID along with an upgrade 
license determine the final capacity of an MX5, MX10, or MX40 router. 


The MX5, MX10, MX40, and MX80 routers support the following types of MICs: 


e A built-in 10-Gigabit Ethernet MIC with four 10-Gigabit Ethernet ports 


e Two front-pluggable MICs 


A feature ID is assigned to every license upgrade for enhancing port capacity. Table 35 on page 61 displays 
the chassis types and their associated port capacity, I2C ID, base capacity, feature ID, feature name, and 
the final capacity after a license upgrade. 


Table 46: Upgrade Licenses for Enhancing Port Capacity 


Feature 
ID and 
Chassis Port Feature 
Type Gpaty I2C ID Base Capacity Name Upgrade Capacity 


MX5 20G 0x556 Slot 1 f1—MX5 Slot 1 and 2 
to MX10 


e 1/MICO upgrade 


e 1/MICO 
e 1/MIC1 
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Table 46: Upgrade Licenses for Enhancing Port Capacity (continued) 


Feature 
ID and 
Chassis Port Feature 
Type Gpaty I2C ID Base Capacity Name Upgrade Capacity 
MxX10 40G 0x555 Slot 1 and 2 f2—MX10 © Slot 2 and first 2 ports on Slot 0 
to MX40 
e 1/MICO e 1/MIC1 
upgrade 
e 1/MIC1 e First 2 ports on O/MICO 
MxX40 60G 0x554 Slot 1, SLot 2 and first 2 | f8—MX40 — Slot 2 and all ports on Slot O 
ports on Slot O to MX80 
e 1/MIC1 
upgrade 
e 1/MICO e All 4 ports on 0/MICO 
e 1/MIC1 


e First 2 ports on 
0/MICO 


When installing an upgrade license for enhancing port capacity on MX5, MX10 and MX40 routers, consider 
the following: 


e To upgrade an MX5 router to MX80 router capacity, licenses for all three features (f1, f2, £3) must be 
installed. All three features can be provided in a single license key. 


e Toupgrade an MX10 router to MX40 router capacity, installing a license key with f2 feature is sufficient. 
e Non-applicable feature IDs in a license key reject the upgrade license. For example: 
e Anf1 feature ID on an MX10 upgrade license key rejects the license. 


e Feature IDs f1 and f2 on an MX40 upgrade license key reject the entire license. 


Port Activation on MX104 Routers 


Starting with Junos OS Release 13.3, license keys are available to activate the ports on the MX104 router. 
MxX104 routers have four built-in ports. By default, in the absence of valid licenses, all four built-in ports 
are deactivated. By installing licenses, you can activate any two of the four or all of the four built-in ports. 
For instance, you can install a license to activate the first two built-in ports (xe-2/0/0 and xe-2/0/1) or 
you can install a license to activate the next two built-in ports (xe-2/0/2 and xe-2/0/3). You can also install 
a license to activate all four built-in ports (xe-2/0/0, xe-2/0/1, xe-2/0/2, and xe-2/0/3). If you have already 
activated two of the built-in ports, you can install an additional license to activate the other two built-in 
ports on the MX104 router. 


A feature ID is assigned to every license for activating the built-in ports on the MX104 router. The port 
license model with the feature ID is described in Table 36 on page 62. 


Table 47: Port Activation License Model for MX104 Routers 


Feature ID Feature Name Functionality 


F1 MX104 2X10G Port Activate (Oand1) | Ability to activate first two built-in ports (xe-2/0/0 
and xe-2/0/1) 


F2 MX104 2X10G Port Activate (2 and 3) Ability to activate next two built-in ports (xe-2/0/2 
and xe-2/0/3) 


Both the features are also provided in a single license key for ease of use. To activate all four ports, you 
must either install the licenses for both the features listed in Table 36 on page 62 or the single license key 
for both features. If you install the single license key when feature IDs F1 and F2 are already installed, the 
license does not get rejected. Also, MX104 routers do not support the graceful license expiry policy. A 
graceful license expiry policy allows the use of a feature for a certain period of time (usually a grace period 
of 30 days), and reverts if the license for that feature is not installed after the grace period. 


Subscriber Access Licensing Overview 


To enable some Juniper Networks Junos OS features or router scaling levels, you might have to purchase, 
install, and manage separate software license packs. The presence on the router of the appropriate software 
license keys (passwords) determines whether you can configure and use certain features or configure a 
feature to a predetermined scale. 


You need only one license if the DHCP dual stack session running with a single SDB session. To configure 
the single SDB session, use the classification-key option in the edit system services dhcp-local-server 
hierarchy . 


Table 48 on page 134 describes number of subscriber interface and license required on subscriber access 
models. 


Table 48: Number of Licenses Required per Access Model 


Access Model Number of Licenses Required 
CVLAN DHCPv4 1 

CVLAN PPPoEv4 1 

CVLAN Dual Stack DHCP 1 (single SDB session) 


2 (two SDB session) 


CVLAN Dual Stack PPPoE a 


Pseudowire Headend Termnation (PWHT) DHCPv4 1. 
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Table 48: Number of Licenses Required per Access Model (continued) 


Access Model Number of Licenses Required 
PWHT PPPoEv4 1 
PWHT Dual Stack DHCP 1 (single SDB session) 


2 (dual SDB session) 


PWHT Dual Stack PPPoE 1 
Agent circuit identifier (ACI) DHCPv4 Number of sessions with same ACI 
ACI PPPoEv4 Number of sessions with same ACI 


Layer 2 Tunneling Protocol (L2TP) Point-to-Point Protocol (PPP) or 4: 
L2TP access concentrator (LAC) 


L2TP Point-to-Point Protocol (PPP) or L2TP network server (LNS) 1 


L2TP Dual Stack PPP or LNS 1 
L2TP tunnel switch (LTS) PPPv4 1 
LTS version Dual Stack PPP al 
Wi-Fi access gateway (WAG) DHCPv4 1 
WAG Dual Stack DHCP 1 (single SDB session) 


2 (dual SDB session) 
Hybrid access gateway (HAG) generic routing encapsulation (GRE)v4 | 1 


Hybrid access gateway (HAG) Dual Stack GRE 1 (single SDB session) 


2 (two SDB session) 


Fixed wireless a 


For the latest information about subscriber access licensing, contact your Juniper Networks sales 
representative at https://www.juniper.net/in/en/contact-us/. 
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Subscriber Secure Policy Licensing Requirements 


To enable and use subscriber secure policy, you must install and properly configure the Subscriber Secure 


Policy license. 


SEE ALSO 


Configuring the Router to Strictly Enforce the Subscriber Scaling License | 148 


Address-Assignment Pools Licensing Requirements 


The address-assignment pool feature is part of the Junos OS Subscriber Management Feature Pack license. 
You must install and properly configure the license to meet the requirements for using the 
address-assignment pool feature. 


Release History Table 
Release Description 
16.1R1 Starting in Junos OS Release 16.1R1, after the completion of the 30 day grace period, DHCP 


bindings on MX series devices are limited to 10. This counts against broadband scale licenses 
S-MX104-SA-FP and S-SA-4K. 


16.1 Starting in Junos OS Release 16.1, there is also a base variant, making a total of three licence 
variants. 
14.2 Starting with Junos OS Release 14.2, you can set the license mode for enhanced MPCs such 


as MPC4E, MPCS5E, and MPCé. 


RELATED DOCUMENTATION 


Configuring the JET Application and its License on a Device Running Junos OS | 146 
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| Licenses for VMX 


IN THIS SECTION 


@  vMxX Licenses for AWS | 137 
@ ~~ vMxX Licenses for KVM and VMware | 138 
@ = Managing vMX Licenses | 140 


vMxX Licenses for AWS 


Licenses are required to use vMX features in the Amazon Bring Your Own License (BYOL) model on AWS. 
When you order licenses, this information is bound to a customer ID. If you did not order the licenses, 
contact your account team or Juniper Networks Customer Care for assistance. 


The vMxX licenses are based on application packages and processing capacity. Table 49 on page 137describes 
the features available with application packages. 


Table 49: Application Packages for Licenses 


Application Package Features 


BASE IP routing with up to 256,000 routes in the forwarding table 


Basic Layer 2 functionality, Layer 2 bridging and switching 


ADVANCE Features in the BASE application package, plus: 
IP routing with up to 2,000,000 routes in the forwarding table 
IP and MPLS switching for unicast and multicast applications 


Layer 2 features—Layer 2 VPN, VPLS, EVPN, and Layer 2 Circuit 


PREMIUM Features in the BASE and ADVANCE application packages, plus: 
IP routing with up to 4,000,000 routes in the forwarding table 
Layer 3 VPN for IP and multicast 


IPsec 
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An application package is associated with a bandwidth license. Bandwidth licenses that are not associated 
with a specific application package apply to all application packages. Bandwidth licenses are additive. For 
example, if you add a 500 Mbps license and a 1 Gbps license, you are entitled to use 1.5 Gbps of capacity. 


vMX Evaluation License 


Juniper Networks provides a 60-day evaluation license for VMX. On AWS, you can try one instance for 
60 days with the BYOL model without incurring hourly software charges for this instance but AWS 
infrastructure charges still apply. 


For information about the 60-day evaluation license for vMX, see 
https://www.juniper.net/us/en/dm/free-vmx-trial/. 


vMX License Model Numbers 
The Juniper Networks licenses are based on SKUs, which represent lists of features that the license enables. 
The following SKUs are supported for vMX Bring Your Own License (BYOL): 


e VMX-100M-1YR 

e VMX-250M-1YR 

e VMX-500M-1YR 

e VMX-PRM-1G-1YR 
e VMX-PRM-5G-1YR 
e VMX-PRM-10G-1YR 


vMxX Licenses for KVM and VMware 


Licenses are required for using vMX features. When you order licenses, this information is bound to a 
customer ID. If you did not order the licenses, contact your account team or Juniper Networks Customer 
Care for assistance. When you order a license, you receive instructions for generating license activation 
keys on the Juniper Networks License Management System. 


The vMx licenses are based on application packages and processing capacity. Table 50 on page 138 describes 
the features available with application packages. 


Table 50: Application Packages for Licenses 


Application Package Features 


BASE IP routing with 256,000 routes in the forwarding table 
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Table 50: Application Packages for Licenses (continued) 


Application Package Features 


ADVANCE Features in the BASE application package 
IP routing with up to 2,000,000 routes in the forwarding table 


16 instances of Layer 3 VPN 


PREMIUM Features in the BASE and ADVANCE application packages 
IP routing with up to 4,000,000 routes in the forwarding table 


Layer 3 VPN for IP and multicast 


Table 51 on page 139 describes the queuing licenses. 


Table 51: vMX Queuing License 


Queuing License SKU Description 
VMX-1G-Q 1 Gbps queuing 
VMX-5G-Q 5 Gbps queuing 
VMX-10G-Q 10 Gbps queuing 
VMX-40G-Q 40 Gbps queuing 
VMX-100G-Q 100 Gbps queuing 


An application package is associated with a bandwidth license. vMX provides egress bandwidth in the 
following capacities: 100 Mbps, 250 Mbps, 500 Mbps, 1 Gbps, 5 Gbps, 10 Gbps, and 40 Gbps. Bandwidth 
licenses that are not associated with a specific application package apply to all application packages. 
Bandwidth licenses are additive. For example, if you add a 500 Mbps license and a 1 Gbps license, you are 
entitled to use 1.5 Gbps of capacity. 


You can download the vMX software BASE application package with 1 Mbps bandwidth and evaluate it 
without a license. To use additional features, you must order the appropriate license. If you delete all valid 
licenses, you can only use the BASE application package with 1 Mbps bandwidth. 


Supported in Junos OS Release 15.1F4 you can download the vMX software BASE application package 
with 1 Mbps bandwidth and evaluate it for 30 days without a license. To use additional features beyond 
the 30 days, you must order the appropriate license. 
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If you upgrade from a BASE package license to an ADVANCE or PREMIUM package license or if you 
downgrade from an ADVANCE or PREMIUM package license to a BASE package license, you must restart 
the routing protocol process. If your configuration has logical systems, you must restart the routing protocol 
process for all logical systems. 


If you need to move your vMX installation to another host, you must remove vMX from the current host 
before installing vMX and adding the license on the new host. 


Starting in Junos OS Release 17.2 with the appropriate VMX PREMIUM license, you can evaluate VBNG 
without a vBNG subscriber scale license for 30 days. After 30 days, you are limited to 10 subscriber 
sessions. 


To deploy a vBNG instance, you must purchase these licenses: 


e vVMX PREMIUM application package license with 1 Gbps, 5 Gbps, 10 Gbps, or 40 Gbps bandwidth 


e vVBNG subscriber scale license with 1000, 10 thousand, 100 thousand, or 1 million subscriber sessions 
for one of these tiers: 


Table 52: vBNG Subscriber Scale License Tiers 


Tier Description 


Introductory L2TP features including L2TP LNS services, secure policy, service activation and 


deactivation 


Preferred Features in the Introductory tier, and DHCP subscriber services, PPP/LAC subscriber 
services, DHCP relay and DHCP local server 


Elite Features in the Preferred tier, and pseudowire head end termination, Gx, and Gy 


Managing vMX Licenses 


IN THIS SECTION 


@ = Adding a License | 141 
@ Deleting a License | 142 


You must add a license to use vMX features. The licensed features are enforced based on the license you 
purchased. 
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Starting in Junos OS Release 17.4 for AWS, you must add a license if you are using vMX in the Bring Your 
Own License (BYOL) model. 


If you upgrade from a BASE package license to an ADVANCE or PREMIUM package license or if you 
downgrade from an ADVANCE or PREMIUM package license to a BASE package license, you must restart 
the routing protocol process (restart routing). If your configuration has logical systems, you must restart 
the routing protocol process for all logical systems (restart routing logical-system logical-system-name). 


If you need to move your vMX installation to another host, you must remove vMX from the current host 
before installing vMX and adding the license on the new host. 


Adding a License 
To add a license key to the vMX: 


1. Copy the license activation key file to the VCP and add the license key by specifying the filename. 


user@vmx> request system license add filename 


Or, you can copy and paste the license activation key directly to add the license key. For example: 


user@vmx> request system license add terminal 

XXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
XXXXXX XXXXXX 


2. Verify that the license is installed. VMX-BANDWIDTH indicates the licensed bandwidth (in Mbps) and 
VMX-SCALE indicates the application package. (VMX-SCALE 1 is the BASE package, VMX-SCALE 2 is 
the ADVANCE package, and VMX-SCALE 3 is the PREMIUM package.) This information is also listed 
as Features in the Licenses installed section. For example, this output indicates that the 40G perpetual 
license for the PREMIUM application package is installed. 


user@vmx> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-12tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
VMX-BANDWIDTH 40000 40000 0 permanent 
VMX-SCALE 3 3 0 permanent 





Licenses installed: 


License identifier: JUNOS640113 
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License version: 4 
Software Serial Number: XXXXXXX 
Customer ID: vMX—-Juniper 
Features: 
vmx-bandwidth-40g - vmx-bandwidth—40g 


permanent 





vmx—-feature-premium vmx—feature-premium 


permanent 


3. Verify the configured bandwidth for PFE traffic matches the licensed bandwidth (VMX-BANDWIDTH). 
The current and average bandwidth are also displayed. 


user@vmx> show pfe statistics traffic bandwidth 


Configured Bandwidth : 40000000000 bps 
Bandwidth Ta Ombps 
Average Bandwidth OmbpS 


Deleting a License 


To delete a vMxX license: 
1. Display the installed licenses. 
user@vmx> show system license installed 


License identifier: JUNOS640113 





License version: 4 
Features: 
vmx-bandwidth—-40g - vmx-bandwidth—40g 


permanent 





vmx—-feature-premium vmx—-feature-premium 


permanent 


2. Delete the license. 


user@vmx> request system license delete license-identifier 


For example: 


user@vmx> request system license delete JUNOS640113 


3. Verify that the license is deleted. 


user@vmx> show system license 


License usage: 
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Licenses Licenses Licenses Expiry 
Feature name used installed needed 
scale-subscriber 0 1000 0 permanent 
scale-12tp 0 1000 0 permanent 
scale-mobile-ip 0 1000 0 permanent 
Licenses installed: none 
Release History Table 
Release Description 
17.4 Starting in Junos OS Release 17.4 for AWS, you must add a license if you are using vMX in the 
Bring Your Own License (BYOL) model. 
d72 Starting in Junos OS Release 17.2 with the appropriate VMX PREMIUM license, you can evaluate 


vBNG without a vBNG subscriber scale license for 30 days. After 30 days, you are limited to 10 


subscriber sessions. 


| License Configuration 
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@ Installing Junos OS Licenses on Virtual Chassis Member Routers | 144 
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Installing Junos OS Licenses on Virtual Chassis Member Routers 


IN THIS SECTION 


@ Installing Junos OS Licenses on Members | 144 


@ Reinstalling Junos OS Licenses on New Members | 145 


To enable some Junos OS features or router scaling levels, you might have to purchase, install, and manage 
separate software license packs. The presence on the router of the appropriate software license keys 
(passwords) determines whether you can configure and use certain features or configure a feature to a 
predetermined scale. 


Before you configure an MX Series Virtual Chassis, install the following Junos OS software licenses on 
each MX Series router to be configured as a member of the Virtual Chassis: 


MX Virtual Chassis Redundancy Feature Pack—You must install a unique MX Virtual Chassis Redundancy 
Feature Pack for each member router in the Virtual Chassis. If you issue the request virtual-chassis 
member-id set, request virtual-chassis member-id delete, request virtual-chassis vc-port set, or request 
virtual-chassis vc-port delete command to set or delete member IDs or Virtual Chassis ports without 
first installing an MX Virtual Chassis Redundancy Feature Pack on both member routers, the software 
displays a warning message that you are operating without a valid Virtual Chassis software license. 


There is no separate license for Virtual Chassis like there is for Virtual Chassis Fabric. 


Junos OS feature licenses—Purchase and install the appropriate Junos OS feature licenses to enable use 
of a particular software feature or scaling level in your network. You must install the required feature 
licenses on each member router in the Virtual Chassis. 


Sometimes, if a Virtual Chassis member is newly installed, the licenses are lost, creating a situation in which 
any new license installed in master Routing Engine will get synced across all members, but any previously 
installed license (any license installed before the newly installed member) does not get synced. In this case, 
you must reinstall (delete and add) licenses in the master Routing Engine if a Virtual Chassis member is 
replaced. This procedure will sync all installed licenses to all members. 


This topic covers the following procedures: 

Installing Junos OS Licenses on Members 

Before you begin: 

e Prepare your site for the Virtual Chassis configuration. 
See Preparing for a Virtual Chassis Configuration. 


e Familiarize yourself with the procedures for installing and managing Junos OS licenses. 


See Software Installation and Upgrade Guide. 


To install Junos OS licenses on each member router in the Virtual Chassis: 


1. Install the required licenses on the MX Series router to be designated as the protocol master for the 


Virtual Chassis. 


a. Install the MX Virtual Chassis Redundancy Feature Pack. 


b. Install the Junos OS feature licenses required for your software feature or scaling level. 


2. Install the required licenses on the MX Series router to be designated as the protocol backup for the 


Virtual Chassis. 


a. Install the MX Virtual Chassis Redundancy Feature Pack. 


b. Install the Junos OS feature licenses required for your software feature or scaling level. 


3. (Optional) Verify the license installation on each member router. 


For example: 


user@host> show system license 


License usage: 


iS ener wers Smee: 
subscriber-accounting 
subscriber-—authentication 
subscriber-—address-—assignment 
subscriber-vlan 

subscriber-ip 
scale-subscriber 

scale-1l2tp 

scale-mobile-ip 


virtual-chassis 


Licenses 


used 


aa] ao 2 2 2 © & 


Reinstalling Junos OS Licenses on New Members 


When you need to install a new Virtual Chassis member router, use this procedure to ensure all installed 


licenses are synced to all members. 


Before adding the new Routing Engine to the Virtual Chassis, install required operational packages. This 


Licenses 


installed 


PPP PR 


256000 
1000 
1000 


is like the first procedure, Installing Junos OS Licenses on Members. 


Licenses 


needed 





en en re 


To sync Junos OS licenses from master to newly replaced virtual chassis members: 


1. On the master router, exit the CLI to switch to user root. 





Expiry 


permanent 
permanent 
permanent 
permanent 
permanent 
permanent 
permanent 
permanent 


permanent 
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{master:member0O-rel } 


user@host> start shell user root 


{master:member0O-rel } 


Password: 


2. Enter the root password and go back into the CLI. 


root@host% cli 


3. Copy the licenses from the master member to the Routing Engine that does not have licenses installed 
(that is, the newly installed Routing Engine). 


{master:member0O-rel } 


user@host> file copy /config/license/*.lic member0O-re0:/config/license/ 


{master:memberO-rel } 


user@host> 


SEE ALSO 


License Modes for Enhanced MPCs Overview | 123 
Configuring the License Mode for Specific Enhanced MPCs on MX Series Routers | 124 


Software Features That Require Licenses on MX Series Routers Only | 109 


Configuring the JET Application and its License on a Device Running Junos OS 
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Before you can start a JET application on a device running Junos OS, first determine if you must configure 
the license. License configuration for JET applications is required only if you are deploying on-box 
applications written in C or C++ and built using the Juniper Extension Toolkit (JET) development 
environment. This task is not required for simple Python JET applications, which do not require licensing. 


This topic describes how to configure two types of JET applications to run on Junos OS: Python applications 
and C or C++ applications. 

Configuring a Python Application to Run on Junos OS 

To configure a JET Python application to run on a device running Junos OS and its license: 


1. (Optional if Python application is signed) Issue the set system scripts language (python | python3) 
command. 


[edit] 
user@device# set system scripts language python 


If you do not include the language python or language python3 statement, you cannot execute unsigned 
Python scripts on the device. 


Junos OS supports using symbolic links for files in the /var/db/scripts/jet directory, but the device will 
only execute the script at the target location if it is signed. 


2. At the [edit system extensions] hierarchy level, configure the application’s provider’s ID. The same 
provider license must be used to configure a JET application to run on Junos OS as was used to package 
it. 


[edit system extensions] 
user@device# set providers xyzcompany 


3. Configure the license type and deployment scope. 


[edit system extensions] 
user@device# set providers xyzcompany license-type juniper deployment-scope commercial 


4. Commit the configuration. 


[edit system extensions] 
user@device# top 

[edit] 

user@device# commit 
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Configuring a C or C++ Application to Run on Junos OS 

To configure a JET C or C++ application to run on a device running Junos OS and its license: 

1. Configure the application's provider's ID, license type, and deployment scope. The same provider license 
must be used to configure a JET application to run on Junos OS as was used to package it. 


The following application example was packaged using chef as the provider license: 


[edit] 
user@device# set system extensions providers chef license-type juniper deployment-scope commercial 


2. Commit the configuration and exit to operational mode. 


[edit] 
user@device# commit 
commit complete 


[edit] 
user@device# exit 
user@device> 


SEE ALSO 


JET Overview 
License Modes for Enhanced MPCs Overview | 123 
Configuring the License Mode for Specific Enhanced MPCs on MX Series Routers | 124 


Software Features That Require Licenses on MX Series Routers Only | 109 





Configuring the Router to Strictly Enforce the Subscriber Scaling License 


To enable some Juniper Networks Junos OS features or router scaling levels, you might have to purchase, 
install, and manage separate software license packs. The presence on the router of the appropriate software 
license keys (passwords) determines whether you can configure and use certain features or configure a 
feature to a predetermined scale. 


For the latest information about subscriber access licensing, contact your Juniper Networks sales 
representative at https://www.juniper.net/in/en/contact-us/. 


Subscriber Secure Policy Licensing Requirements 


To enable and use subscriber secure policy, you must install and properly configure the Subscriber Secure 
Policy license. 


You can configure the router to strictly enforce the subscriber scaling feature, which is part of the Junos 
Subscriber Access Feature Pack license. The subscriber scaling feature specifies the maximum number of 
subscribers that can be logged in at any one time. 


When you configure strict scaling license support, the router performs the following actions: 


e Strictly enforces the subscriber scaling license and does not allow any grace period. When the number 
of logged-in subscriber reaches the number allowed by the scaling license, no additional subscribers are 
allowed to log in. 


e Creates the informational log message, “90 percent of installed subscriber scale licenses in use" in 
/var/log/messages, to inform you when you have 10 percent of the total allowed licenses remaining. 
The router clears this condition when license usage falls below 90 percent. The log message is created 
again if the 90 percent usage is later reached. 


To configure the router to strictly enforce the subscriber scaling license: 


1. Specify that you want to configure subscriber management. 


[edit system services] 
user@host# edit subscriber-management 


2. Configure the router to enforce the scaling license. 


[edit system services subscriber-management] 
user@host# set enforce-strict-scale-limit-license 
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To enable and use some of the Juniper Networks operating system (Junos OS) features, you must purchase, 
install, and manage separate software licenses. If the switch has the appropriate software license, you can 
configure and use these features. 


The Junos OS feature license (that is, the purchased authorization code) is universal. However, to conform 
to Junos OS feature licensing requirements, you must install a unique license key (a combination of the 
authorization code and the switch’s serial number) on each switch. 


For a Virtual Chassis deployment, two license keys are recommended for redundancy—one for the device 
in the master role and the other for the device in the backup role: 


e In an EX8200 Virtual Chassis, the devices in the master and backup roles are always XRE200 External 
Routing Engines. 


e Inall other Virtual Chassis, the devices in the master and backup roles are switches. 


You do not need additional license keys for Virtual Chassis member switches that are in the linecard role 
or for the redundant Routing Engine (RE) modules or the redundant Switch Fabric and Routing Engine 
(SRE) modules in an EX8200 member switch. 


This topic describes: 


Purchasing a Software Feature License 


The following sections list features that require separate licenses. To purchase a software license, contact 
your Juniper Networks sales representative (https://www.juniper.net/us/en/contact-us/sales-offices). 
You will be asked to supply the chassis serial number of your switch; you can obtain the serial number by 
running the show chassis hardware command. 


You are required to provide the 12-digit serial number when purchasing a license for an XRE200 External 
Routing Engine in an EX8200 Virtual Chassis. 


The serial number listed on the XRE200 External Routing Engine serial ID label is 16 digits long. Use the 
last 12 digits of the 16-digit serial number to purchase the license. 


You can use the show chassis hardware command output to display the 12-digit serial number of the 


XRE200 External Routing Engine. 


License Key Components for the EX Series Switch 


When you purchase a license for a Junos OS feature that requires a separate license, you receive a license 
key. 


A license key consists of two parts: 


e License ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, 
it is given a license ID. 
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e License data—Block of binary data that defines and stores all license key objects. 


For example, in the following typical license key, the stringJunos204558 is the license ID, and the trailing 
block of data is the license data: 


XXKXKKXKXKXKXKXK XXXXXK XXKXKXKXKX XXKXKKK KRXKXKXKXK XKXKXKKK XXKKKNK 
XXXXXX XXXXXKX XXXXXK XXXXKK XXAXKXKXXK XXXKKK 
XXXXXX XXXXXX XXX 


The license data defines the device ID for which the license is valid and the version of the license. 


Features Requiring a License on EX2200 Switches 


For EX2200 switches, the following features can be added to basic Junos OS by installing an enhanced 
feature license (EFL): 


e Bidirectional Forwarding Detection (BFD) 

e Connectivity fault management (IEEE 802.1ag) 

e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 

e OSPFv1/v2 (with four active interfaces) 

e Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 
e Q-in-Q tunneling (IEEE 802.1ad) 

e Real-time performance monitoring (RPM) 

e Virtual Router 

e Virtual Router Redundancy Protocol (VRRP) 


Table 53 on page 152 lists the EFLs that you can purchase for EX2200 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX2200 switch. 


Table 53: Junos OS Part Number on EX2200 Switches 


Switch Model Part Number 


EX2200-C-12P-2G EX-12-EFL 
EX2200-C-12T-2G 


EX2200-24T-4G EX-24-EFL 
EX2200-24P-4G 
EX2200-24T-DC-4G 


EX2200-48T-4G EX-48-EFL 
EX2200-48P-4G 
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Features Requiring a License on EX2300 Switches 


EX2300 switches have enhanced feature licenses (EFLs). 


To use the following features on the EX2300 switches, you must install an EFL: 


Bidirectional Forwarding Detection (BFD) 
IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


IPv6 routing protocols: Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM multicast, 
VRRPv3 


Multicast Source Discovery protocol (MSDP) 

Operations Administration Management (OAM) (Connectivity Fault Management (CFM) 

OSPF v2/v3 

Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 
Real-time performance monitoring (RPM) 

RIPng (RIPng is for RIP IPvé) 


Virtual Router Redundancy Protocol (VRRP) 


Table 54 on page 153 lists the EFLs that you can purchase for EX2300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX2300 switch. 


Table 54: Junos OS Part Number on EX2300 Switches 


Switch Model Part Number 


EX2300-C-12P EX-12-EFL 
EX2300-C-12T 


EX2300-24T EX-24-EFL 
EX2300-24P 
EX2300-24MP 


EX2300-48T EX-48-EFL 
EX2300-48P 
EX2300-48MP 


Virtual Chassis feature support on EX2300 switches: 


The EX-12-EFL SKU includes the EX2300-VC (Virtual Chassis feature) license. EX2300-C-12P and 
EX2300-C-12T switches do not require an additional EX2300-VC license if you purchases the EFL 
license. 
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e EX2300-24T, EX2300-24P, EX2300-24MP, EX2300-48T, EX2300-48P, and EX2300-48MP switches 
do not include the EX2300-VC (Virtual Chassis feature). If you want to use Virtual Chassis feature, you 
must purchase a separate EX2300-VC license for each EX2300 switch. 


Features Requiring a License on EX3300 Switches 


Two types of licenses are available on EX3300 switches: enhanced feature licenses (EFLs) and advanced 
feature licenses (AFLs). 


To use the following features on the EX3300 switches, you must install an EFL: 


e Bidirectional Forwarding Detection (BFD) 
e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


e IPvé routing protocols: Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM multicast, 
VRRPVv3, virtual router support for unicast and filter-based forwarding (FBF) 


e Intermediate System-to-Intermediate System (IS-IS) 

e OSPFv1/v2 

e Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 
e Q-in-Q tunneling (IEEE 802.1ad) 

e Real-time performance monitoring (RPM) 

e Unicast reverse-path forwarding (RPF) 

e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 55 on page 154 lists the EFLs that you can purchase for EX3300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX3300 switch. 


Table 55: Junos OS Part Number on EX3300 Switches 


Switch Model Part Number 
EX3300-24T EX-24-EFL 
EX3300-24P 


EX3300-24T-DC 


EX3300-48T EX-48-EFL 
EX3300-48T-BF 
EX3300-48P 
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To use the following feature on EX3300 switches, you must install an AFL: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
e IPvé routing protocols: IPv6 BGP and IPvé for MBGP 
e Virtual routing and forwarding (VRF) BGP 


Table 56 on page 155 lists the AFLs that you can purchase for EX3300 switch models. For EX3300 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 
features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX3300 switch. 


Table 56: Junos OS AFL Part Number on EX3300 Switches 


Switch Model AFL Part Number 
EX3300-24T EX-24-AFL 
EX3300-24P 


EX3300-24T-DC 


EX3300-48T EX-48-AFL 
EX3300-48T-BF 
EX3300-48P 


Features Requiring a License on EX3400 Switches 


EX3400 switches has an enhanced feature licenses (EFLs) and MACSec license. 
To use the following features on the EX3400 switches, you must install an EFL: 


Bidirectional Forwarding Detection (BFD) 


e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


IPv6 routing protocols: : Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM 
multicast, VRRPv3, virtual router support for unicast and filter-based forwarding (FBF) 


Multicast Source Discovery Protocol (MSDP) 


Operations Administration Management (OAM) (Connectivity Fault Management (CFM) 
OSPF v2/v3 


Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


Real-time performance monitoring (RPM) 


RIPng (RIPng is for RIP IPvé) 


e Unicast reverse-path forwarding (RPF) 
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e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 57 on page 156 lists the EFLs that you can purchase for EX3400 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX3400 switch. 


Table 57: Junos OS Part Number on EX3400 Switches 


Switch Model Part Number 
EX3400-24T EX-24-EFL 
EX3400-24P 

EX3400-48P EX-48-EFL 
EX3400-48T 


EX3400-48T-AFI 
EX3400-48T-DC 
EX3400-48T-DC-AFI 


To use the following features on the EX3400 switches, you must install an AFL: 
e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 


e Intermediate System-to-Intermediate System (IS-IS) 


Table 58 on page 156 lists the AFLs that you can purchase for EX3400 switch models. For EX3400 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 
features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX3400 switch. 


Table 58: Junos OS Part Number on EX3400 Switches 


Switch Model Part Number 
EX3400-24T EX-24-AFL 
EX3400-24P 

EX3400-48P EX-48-AFL 
EX3400-48T 


EX3400-48T-AFI 
EX3400-48T-DC 
EX3400-48T-DC-AFI 


You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 
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To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX3400 switches. 
Table 59 on page 157 lists the MACsec model number that you can purchase for EX3400 switch models. 
Table 59: Junos OS MACsec model number on EX3400 Switches 


Switch Model Model Number 


EX3400 EX-QFX-MACSEC-ACC 


Features Requiring a License on EX4300 Switches 


Two types of licenses are available on EX4300 switches: enhanced feature licenses (EFLs) and advanced 
feature licenses (AFLs). 


To use the following features on the EX4300 switches, you must install an EFL: 


e Bidirectional Forwarding Detection (BFD) 


Connectivity fault management (IEEE 802.1ag) 
e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


Multicast Source Discovery Protocol (MSDP) 


Operations Administration Management (OAM) (Connectivity Fault Management (CFM)) 
OSPFv2/v3 


Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


Real-time perfomance monitoring (RPM) 


RIPng (RIPng is for RIP IPvé6) 


e Unicast reverse-path forwarding (RPF) 
e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 60 on page 158 lists the EFLs that you can purchase for EX4300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX4300 switch. 


Table 60: Junos OS Part Number on EX4300 Switches 


Switch Model Part Number 
EX4300-24T EX4300-24-EFL 
EX4300-24P 

EX4300-48MP EX4300-48-EFL 
EX4300-48P 

EX4300-48T 


EX4300-48T-AFI 
EX4300-48T-DC 
EX4300-48T-DC-AFI 


EX4300-32F EX4300-32F-EFL 
EX4300-32F-DC 


To use the following features on EX4300 switches, you must install an AFL: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
e Intermediate System-to-Intermediate System (IS-IS) 
e Ethernet VPN (EVPN) with Virtual Extensible LAN (VXLAN) 
e Supported only on EX4300-48MP switch. 
e Requires the Border Gateway Protocol (BGP) for configuration. 
Table 61 on page 158 lists the AFLs that you can purchase for EX4300 switch models. For EX4300 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 


features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX4300 switch. 


Table 61: Junos OS AFL Part Number on EX4300 Switches 


Switch Model AFL Part Number 
EX4300-24T EX4300-24-AFL 
EX4300-24P 

EX4300-48MP EX4300-48-AFL 
EX4300-48P 

EX4300-48T 


EX4300-48T-AFI 
EX4300-48T-DC 
EX4300-48T-DC-AFI 
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Table 61: Junos OS AFL Part Number on EX4300 Switches (continued) 


Switch Model AFL Part Number 


EX4300-32F EX4300-32F-AFL 
EX4300-32F-DC 


You must download a MACsec feature license (Part Number-EX-QFX-MACSEC- ACC) to enable MACsec. 
The MACsec feature license is an independent feature license; the enhanced feature licenses (EFLs) or 
advanced feature licenses (AFLs) that must be purchased to enable some features on EX Series switches 
cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4300 switches. 
Table 62 on page 159 lists the MACsec model number that you can purchase for EX4300 switch models. 
Table 62: Junos OS MACsec model number on EX4300 Switches 


Switch Model Model Number 


EX4300 EX-QFX-MACSEC-ACC 


Features Requiring a License on EX4600 Switches 


To use the following features on EX4600 switches, you must install an advanced feature license: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
e Intermediate System-to-Intermediate System (IS-IS) 

e Multiprotocol Label Switching (MPLS) 

e Virtual Extensible LAN (VXLAN) 


Table 63 on page 159 lists the AFLs that you can purchase for EX4600 switch models. 
Table 63: Junos OS AFL Part Number on EX4600 Switches 


Switch Model AFL Part Number 


EX4600-40F EX4600-AFL 
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You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4600 switches. 
Table 64 on page 160 lists the MACsec model number that you can purchase for EX4600 switch models. 
Table 64: Junos OS AFL Part Number on EX4600 Switches 


Switch Model Model Number 


EX4600-40F EX-QFX-MACSEC-AGG 


Features Requiring a License on EX4650 Switches 


Table 65 on page 160 lists the PFLs and AFLs that you can purchase for EX4650 switch models. If you have 
the license, you can run all of the premium and advanced software features mentioned below on your 
EX4650 switch. 


Table 65: Junos OS Part Numbers on EX4650 Switches 


Switch Model License Type Part Number 
EX4650-48Y Premium EX4650-PFL 
EX4650-48Y Advanced EX4650-AFL 


Table 66 on page 160 lists the standard Junos OS features which require licenses on EX4650 switches. 
Table 66: Features which Require Licenses on EX4650 Switches 


License Model Detailed Features 


Base Features Basic IPv6, BFD, CFM (IEEE 802.1ag), Class of service (COS)/ Policing/Shaping/Marking, 
Filtering, IGMPv1/v2/v3 (includes IGMP Snooping), Junos Telemetry Interface, MC-LAG, 
MLDv1/v2 and MSDP, OSPFv2 and OSPFv3, PIM-DM/SM/SSM and PIMv6, Q-in-Q 
tunneling (IEEE 802.1ad), RIPng and RPM, Timing - Boundary Clock and Timing - 
Transparent Clock, Unicast reverse-path forwarding (RPF), VC, Virtual Router, VRRP, and 
VRRPvVv6, Zero Touch Provisioning (ZTP) 
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Table 66: Features which Require Licenses on EX4650 Switches (continued) 


License Model Detailed Features 


Premium Features Includes all base features, BGP and MBGP, Ethernet VPN, IPv6 for BGP or MGBP, IS-IS or 
IPv4 and IPv6é, VRF, VXLAN 


Advanced Features Includes all PFL features, MPLS, MPLS based Circuit cross-connect (CCC), Resource 
Reservation Protocol (RSVP) label-switched path (LSP), Segment Routing, MACsec is not 
supported on EX4650 switch. 


Features Requiring a License on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 
and EX9250 Switches 


To use the following features on EX3200, EX4200, EX4500, EX4550, EX8200, EX9200 and EX9250 
switches, you must install an advanced feature license (AFL): 


Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 


Ethernet VPN (available only on EX9200 and EX9250 switches) 


Intermediate System-to-Intermediate System (IS-IS) 


IPv6 routing protocols: IS-IS for IPv6é, IPv6 BGP, IPv6é for MBGP 


Logical systems (available only on EX9200 switches) 


MPLS with RSVP-based label-switched paths (LSPs) 


Starting with Junos OS Release 17.3R1, you can enable up to 200 RSVP-TE sessions in the EX9200 
advanced feature license (AFL). 


MPLS-based circuit cross-connects (CCCs) (available only on EX4200 and EX4550 switches) 


Open vSwitch Database (OVSDB) (available only on EX9200 switches) 


e Virtual Extensible LAN (VXLAN) (available only on EX9200 and EX9250 switches) 


To use the following features on Juniper Networks EX6200 Ethernet Switches, you must install an advanced 
feature license (AFL): 


e Border Gateway Protocol (BGP) 
e Intermediate System-to-Intermediate System (IS-IS) 


e IPvé routing protocols: IS-IS for IPv6é, IPv6 BGP 


To use MACsec feature on Juniper Networks EX9253 Switches, you must install an security feature license 
(SFL). 
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To use Forwarding Information Base (FIB) and Address Resolution Protocol (ARP) features on Juniper 
Networks EX9251 and EX9253 Switches, you must install an mid-scale license (ML). 


Table 67 on page 162 lists the AFLs that you can purchase for EX3200, EX4200, EX4500, EX4550, EX6200, 
EX8200, EX9200 and EX9250 switches. If you have the license, you can run all of the advanced software 
features mentioned above on your EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, or EX9200 
switch. An EFL is not applicable to this range of switches. 


Table 67: Junos OS AFL Part Number on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 
and EX9250 Switches 


Switch Model AFL Part Number 


EX3200-24P EX-24-AFL 
EX3200-24T 

EX4200-24F 

EX4200-24P 

EX4200-24PX 

EX4200-24T 


EX3200-48P EX-48-AFL 
EX3200-48T 

EX4200-48F 

EX4200-48P 

EX4200-48PX 

EX4200-48T 


EX4500-40F-BF EX-48-AFL 
EX4500-40F-BF-C 

EX4500-40F-FB 

EX4500-40F-FB-C 


EX4550 


EX6210 


EX8208 


EX8216 


EX-XRE200 


EX9204 


EX9208 


EX4550-AFL 


EX6210-AFL 


EX8208-AFL 


EX8216-AFL 


EX-XRE200-AFL 


EX9204-AFL 


EX9208-AFL 


Table 67: Junos OS AFL Part Number on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 
and EX9250 Switches (continued) 


Switch Model AFL Part Number 
EX9214 EX9214-AFL 
EX9251 EX9251-AFL 
EX9251-ML 
EX9253 EX9253-AFL 
EX9253-ML 
EX9253-SFL 


You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4200 and EX4550 switches. 


Table 68 on page 163 lists the MACsec model number that you can purchase for EX4200 and EX4550 
switch models. 


Table 68: Junos OS MACsec model number on EX4200 and EX4550 Switches 


Switch Model Model Number 
EX4550 EX-QFX-MACSEC-AGG 
EX4200 EX-QFX-MACSEC-ACC 


License Warning Messages 


For using features that require a license, you must install and configure a license key. To obtain a license 
key, use the contact information provided in your certificate. 
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If you have not purchased the AFL or EFL and installed the license key, you receive warnings when you 
try to commit the configuration: 


[edit protocols] 
Noyoio ! 
warning: requires 'bgp' license 


error: commit failed: (statements constraint check failed) 


The system generates system log (syslog) alarm messages notifying you that the feature requires a 
license—for example: 


Seo 8 WS3S9¢ iil craftd[806]: Minor alarm set, BGP Routing Protocol usage requires 
a license 


Se SF WSs S9¢ ili alarmd[805]: Alarm set: License color=YELLOW, class=CHASSIS, 








reason=BGP Routing Protocol usage requires a license 
Sepas US oot alarmd[805]: LICENSE_EXPIRED: License for feature bgp(47) expired 























Output of the show system alarms command displays the active alarms: 


user@switch> show system alarms 


1 alarm currently active 
Alarm time Class Description 


2009-09-03 06:00:11 UTC Minor BGP Routing Protocol usage requires a license 
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To enable and use some of the Juniper Networks operating system (Junos OS) features, you must purchase, 
install, and manage separate software licenses. If the switch has the appropriate software license, you can 
configure and use these features. 


The Junos OS feature license (that is, the purchased authorization code) is universal. However, to conform 
to Junos OS feature licensing requirements, you must install a unique license key (a combination of the 
authorization code and the switch’s serial number) on each switch. 


For a Virtual Chassis deployment, two license keys are recommended for redundancy—one for the device 
in the master role and the other for the device in the backup role: 


e Inan EX8200 Virtual Chassis, the devices in the master and backup roles are always XRE200 External 
Routing Engines. 


e Inall other Virtual Chassis, the devices in the master and backup roles are switches. 


You do not need additional license keys for Virtual Chassis member switches that are in the linecard role 
or for the redundant Routing Engine (RE) modules or the redundant Switch Fabric and Routing Engine 
(SRE) modules in an EX8200 member switch. 


This topic describes: 
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Purchasing a Software Feature License 


The following sections list features that require separate licenses. To purchase a software license, contact 
your Juniper Networks sales representative (https://www.juniper.net/us/en/contact-us/sales-offices). 
You will be asked to supply the chassis serial number of your switch; you can obtain the serial number by 
running the show chassis hardware command. 


You are required to provide the 12-digit serial number when purchasing a license for an XRE200 External 
Routing Engine in an EX8200 Virtual Chassis. 


The serial number listed on the XRE200 External Routing Engine serial ID label is 16 digits long. Use the 
last 12 digits of the 16-digit serial number to purchase the license. 


You can use the show chassis hardware command output to display the 12-digit serial number of the 
XRE200 External Routing Engine. 


License Key Components for the EX Series Switch 


When you purchase a license for a Junos OS feature that requires a separate license, you receive a license 
key. 


A license key consists of two parts: 


e License |ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, 
it is given a license ID. 


e License data—Block of binary data that defines and stores all license key objects. 


For example, in the following typical license key, the stringJunos204558 is the license ID, and the trailing 
block of data is the license data: 


XXXKKXKXKXKKK XXXXXK XXKXKXKXXKX XXKXKKK KXKXKXKXK XKXKXKXKXK XKXKKKNK 
XXXXXX XXXXXX XXXXKXKX XXAXXXX XXXKKKX XXKXKXKK 
XXXXXX XXXXXX XXX 


The license data defines the device ID for which the license is valid and the version of the license. 


Features Requiring a License on EX2200 Switches 


For EX2200 switches, the following features can be added to basic Junos OS by installing an enhanced 
feature license (EFL): 


e Bidirectional Forwarding Detection (BFD) 

e Connectivity fault management (IEEE 802.1ag) 

e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 

e OSPFv1/v2 (with four active interfaces) 

e Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


e Q-in-Q tunneling (IEEE 802.1ad) 


e Real-time performance monitoring (RPM) 
e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 53 on page 152 lists the EFLs that you can purchase for EX2200 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX2200 switch. 


Table 69: Junos OS Part Number on EX2200 Switches 


Switch Model Part Number 


EX2200-C-12P-2G EX-12-EFL 
EX2200-C-12T-2G 


EX2200-24T-4G EX-24-EFL 
EX2200-24P-4G 
EX2200-24T-DC-4G 


EX2200-48T-4G EX-48-EFL 
EX2200-48P-4G 


Features Requiring a License on EX2300 Switches 
EX2300 switches have enhanced feature licenses (EFLs). 
To use the following features on the EX2300 switches, you must install an EFL: 


Bidirectional Forwarding Detection (BFD) 


e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


IPvé routing protocols: Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM multicast, 
VRRPv3 


Multicast Source Discovery protocol (MSDP) 


Operations Administration Management (OAM) (Connectivity Fault Management (CFM) 


OSPF v2/v3 


Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


Real-time performance monitoring (RPM) 


e RIPng (RIPng is for RIP IPvé) 


e Virtual Router Redundancy Protocol (VRRP) 


Table 54 on page 153 lists the EFLs that you can purchase for EX2300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX2300 switch. 


167 


Table 70: Junos OS Part Number on EX2300 Switches 


Switch Model Part Number 


EX2300-C-12P EX-12-EFL 
EX2300-C-12T 


EX2300-24T EX-24-EFL 
EX2300-24P 
EX2300-24MP 


EX2300-48T EX-48-EFL 
EX2300-48P 
EX2300-48MP 


Virtual Chassis feature support on EX2300 switches: 


e The EX-12-EFL SKU includes the EX2300-VC (Virtual Chassis feature) license. EX2300-C-12P and 
EX2300-C-12T switches do not require an additional EX2300-VC license if you purchases the EFL 
license. 


e EX2300-24T, EX2300-24P, EX2300-24MP, EX2300-48T, EX2300-48P, and EX2300-48MP switches 
do not include the EX2300-VC (Virtual Chassis feature). If you want to use Virtual Chassis feature, you 
must purchase a separate EX2300-VC license for each EX2300 switch. 


Features Requiring a License on EX3300 Switches 


Two types of licenses are available on EX3300 switches: enhanced feature licenses (EFLs) and advanced 
feature licenses (AFLs). 


To use the following features on the EX3300 switches, you must install an EFL: 


e Bidirectional Forwarding Detection (BFD) 
e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


e IPvé routing protocols: Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM multicast, 
VRRPVv3, virtual router support for unicast and filter-based forwarding (FBF) 


e Intermediate System-to-Intermediate System (IS-IS) 

e OSPFv1/v2 

e Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 
e Q-in-Q tunneling (IEEE 802.1ad) 

e Real-time performance monitoring (RPM) 


e Unicast reverse-path forwarding (RPF) 
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e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 55 on page 154 lists the EFLs that you can purchase for EX3300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX3300 switch. 


Table 71: Junos OS Part Number on EX3300 Switches 


Switch Model Part Number 
EX3300-24T EX-24-EFL 
EX3300-24P 


EX3300-24T-DC 


EX3300-48T EX-48-EFL 
EX3300-48T-BF 
EX3300-48P 


To use the following feature on EX3300 switches, you must install an AFL: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
e IPvé routing protocols: IPv6 BGP and IPvé for MBGP 


e Virtual routing and forwarding (VRF) BGP 
Table 56 on page 155 lists the AFLs that you can purchase for EX3300 switch models. For EX3300 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 


features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX3300 switch. 


Table 72: Junos OS AFL Part Number on EX3300 Switches 


Switch Model AFL Part Number 
EX3300-24T EX-24-AFL 
EX3300-24P 


EX3300-24T-DC 


EX3300-48T EX-48-AFL 
EX3300-48T-BF 
EX3300-48P 


Features Requiring a License on EX3400 Switches 


EX3400 switches has an enhanced feature licenses (EFLs) and MACSec license. 
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To use the following features on the EX3400 switches, you must install an EFL: 


Bidirectional Forwarding Detection (BFD) 


e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 


IPv6 routing protocols: : Multicast Listener Discovery version 1 and 2 (MLD v1/v2), OSPFv3, PIM 
multicast, VRRPv3, virtual router support for unicast and filter-based forwarding (FBF) 


Multicast Source Discovery Protocol (MSDP) 


Operations Administration Management (OAM) (Connectivity Fault Management (CFM) 
OSPF v2/v3 


Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


Real-time performance monitoring (RPM) 


RIPng (RIPng is for RIP IPvé) 


e Unicast reverse-path forwarding (RPF) 
e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 57 on page 156 lists the EFLs that you can purchase for EX3400 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX3400 switch. 


Table 73: Junos OS Part Number on EX3400 Switches 


Switch Model Part Number 
EX3400-24T EX-24-EFL 
EX3400-24P 

EX3400-48P EX-48-EFL 
EX3400-48T 


EX3400-48T-AFI 
EX3400-48T-DC 
EX3400-48T-DC-AFI 


To use the following features on the EX3400 switches, you must install an AFL: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 


e Intermediate System-to-Intermediate System (IS-IS) 


Table 58 on page 156 lists the AFLs that you can purchase for EX3400 switch models. For EX3400 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 
features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX3400 switch. 
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Table 74: Junos OS Part Number on EX3400 Switches 


Switch Model Part Number 
EX3400-24T EX-24-AFL 
EX3400-24P 

EX3400-48P EX-48-AFL 
EX3400-48T 


EX3400-48T-AFI 
EX3400-48T-DC 
EX3400-48T-DC-AFI 


You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX3400 switches. 
Table 59 on page 157 lists the MACsec model number that you can purchase for EX3400 switch models. 
Table 75: Junos OS MACsec model number on EX3400 Switches 


Switch Model Model Number 


EX3400 EX-QFX-MACSEC-ACC 


Features Requiring a License on EX4300 Switches 


Two types of licenses are available on EX4300 switches: enhanced feature licenses (EFLs) and advanced 
feature licenses (AFLs). 


To use the following features on the EX4300 switches, you must install an EFL: 


e Bidirectional Forwarding Detection (BFD) 

e Connectivity fault management (IEEE 802.1ag) 

e IGMP (Internet Group Management Protocol) version 1 (IGMPv1), IGMPv2, and IGMPv3 
e Multicast Source Discovery Protocol (MSDP) 

e Operations Administration Management (OAM) (Connectivity Fault Management (CFM)) 
e OSPFv2/v3 


e Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse mode 


e Real-time perfomance monitoring (RPM) 
e RIPng (RIPng is for RIP IPvé) 

e Unicast reverse-path forwarding (RPF) 

e Virtual Router 


e Virtual Router Redundancy Protocol (VRRP) 


Table 60 on page 158 lists the EFLs that you can purchase for EX4300 switch models. If you have the 
license, you can run all of the enhanced software features mentioned above on your EX4300 switch. 


Table 76: Junos OS Part Number on EX4300 Switches 


Switch Model Part Number 
EX4300-24T EX4300-24-EFL 
EX4300-24P 

EX4300-48MP EX4300-48-EFL 
EX4300-48P 

EX4300-48T 


EX4300-48T-AFI 
EX4300-48T-DC 
EX4300-48T-DC-AFI 


EX4300-32F EX4300-32F-EFL 
EX4300-32F-DC 


To use the following features on EX4300 switches, you must install an AFL: 


e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
e Intermediate System-to-Intermediate System (IS-IS) 
e Ethernet VPN (EVPN) with Virtual Extensible LAN (VXLAN) 
e Supported only on EX4300-48MP switch. 
e Requires the Border Gateway Protocol (BGP) for configuration. 
Table 61 on page 158 lists the AFLs that you can purchase for EX4300 switch models. For EX4300 switches, 
you must purchase and install a corresponding EFL along with the AFL to enable the advanced license 


features. If you have both these licenses, you can run all of the advanced software features mentioned 
above on your EX4300 switch. 
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Table 77: Junos OS AFL Part Number on EX4300 Switches 


Switch Model AFL Part Number 
EX4300-24T EX4300-24-AFL 
EX4300-24P 

EX4300-48MP EX4300-48-AFL 
EX4300-48P 

EX4300-48T 


EX4300-48T-AFI 
EX4300-48T-DC 
EX4300-48T-DC-AFI 


EX4300-32F EX4300-32F-AFL 
EX4300-32F-DC 


You must download a MACsec feature license (Part Number-EX-QFX-MACSEC- ACC) to enable MACsec. 


The MACsec feature license is an independent feature license; the enhanced feature licenses (EFLs) or 
advanced feature licenses (AFLs) that must be purchased to enable some features on EX Series switches 
cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4300 switches. 


Table 62 on page 159 lists the MACsec model number that you can purchase for EX4300 switch models. 


Table 78: Junos OS MACsec model number on EX4300 Switches 


Switch Model Model Number 


EX4300 EX-QFX-MACSEC-ACC 


Features Requiring a License on EX4600 Switches 

To use the following features on EX4600 switches, you must install an advanced feature license: 
e Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 

e Intermediate System-to-Intermediate System (IS-IS) 

e Multiprotocol Label Switching (MPLS) 

e Virtual Extensible LAN (VXLAN) 


Table 63 on page 159 lists the AFLs that you can purchase for EX4600 switch models. 
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Table 79: Junos OS AFL Part Number on EX4600 Switches 


Switch Model AFL Part Number 


EX4600-40F EX4600-AFL 


You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4600 switches. 
Table 64 on page 160 lists the MACsec model number that you can purchase for EX4600 switch models. 
Table 80: Junos OS AFL Part Number on EX4600 Switches 


Switch Model Model Number 


EX4600-40F EX-QFX-MACSEC-AGG 


Features Requiring a License on EX4650 Switches 


Table 65 on page 160 lists the PFLs and AFLs that you can purchase for EX4650 switch models. If you have 


the license, you can run all of the premium and advanced software features mentioned below on your 
EX4650 switch. 


Table 81: Junos OS Part Numbers on EX4650 Switches 


Switch Model License Type Part Number 
EX4650-48Y Premium EX4650-PFL 
EX4650-48Y Advanced EX4650-AFL 


Table 66 on page 160 lists the standard Junos OS features which require licenses on EX4650 switches. 
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Table 82: Features which Require Licenses on EX4650 Switches 


License Model Detailed Features 


Base Features Basic IPv6, BFD, CFM (IEEE 802.1ag), Class of service (COS)/ Policing/Shaping/Marking, 
Filtering, IGMPv1/v2/v3 (includes IGMP Snooping), Junos Telemetry Interface, MC-LAG, 
MLDv1/v2 and MSDP, OSPFv2 and OSPFv3, PIM-DM/SM/SSM and PIMv6, Q-in-Q 
tunneling (IEEE 802.1ad), RIPng and RPM, Timing - Boundary Clock and Timing - 
Transparent Clock, Unicast reverse-path forwarding (RPF), VC, Virtual Router, VRRP, and 
VRRPvVv6, Zero Touch Provisioning (ZTP) 


Premium Features Includes all base features, BGP and MBGP, Ethernet VPN, IPv6 for BGP or MGBP, IS-IS or 
IPv4 and IPv6é, VRF, VXLAN 


Advanced Features Includes all PFL features, MPLS, MPLS based Circuit cross-connect (CCC), Resource 
Reservation Protocol (RSVP) label-switched path (LSP), Segment Routing, MACsec is not 
supported on EX4650 switch. 


Features Requiring a License on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 and EX9250 
Switches 


To use the following features on EX3200, EX4200, EX4500, EX4550, EX8200, EX9200 and EX9250 
switches, you must install an advanced feature license (AFL): 


Border Gateway Protocol (BGP) and multiprotocol BGP (MBGP) 
Ethernet VPN (available only on EX9200 and EX9250 switches) 


Intermediate System-to-Intermediate System (IS-IS) 


IPv6 routing protocols: IS-IS for IPv6é, IPv6 BGP, IPv6é for MBGP 


Logical systems (available only on EX9200 switches) 


MPLS with RSVP-based label-switched paths (LSPs) 


Starting with Junos OS Release 17.3R1, you can enable up to 200 RSVP-TE sessions in the EX9200 
advanced feature license (AFL). 


MPLS-based circuit cross-connects (CCCs) (available only on EX4200 and EX4550 switches) 


Open vSwitch Database (OVSDB) (available only on EX9200 switches) 


e Virtual Extensible LAN (VXLAN) (available only on EX9200 and EX9250 switches) 


To use the following features on Juniper Networks EX6200 Ethernet Switches, you must install an advanced 
feature license (AFL): 


e Border Gateway Protocol (BGP) 
e Intermediate System-to-Intermediate System (IS-IS) 


e IPvé routing protocols: IS-IS for IPv6é, IPv6 BGP 
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To use MACsec feature on Juniper Networks EX9253 Switches, you must install an security feature license 
(SFL). 


To use Forwarding Information Base (FIB) and Address Resolution Protocol (ARP) features on Juniper 
Networks EX9251 and EX9253 Switches, you must install an mid-scale license (ML). 


Table 67 on page 162 lists the AFLs that you can purchase for EX3200, EX4200, EX4500, EX4550, EX6200, 
EX8200, EX9200 and EX9250 switches. If you have the license, you can run all of the advanced software 
features mentioned above on your EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, or EX9200 
switch. An EFL is not applicable to this range of switches. 


Table 83: Junos OS AFL Part Number on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 
and EX9250 Switches 


Switch Model AFL Part Number 


EX3200-24P EX-24-AFL 
EX3200-24T 

EX4200-24F 

EX4200-24P 

EX4200-24PX 

EX4200-24T 


EX3200-48P EX-48-AFL 
EX3200-48T 

EX4200-48F 

EX4200-48P 

EX4200-48PX 

EX4200-48T 


EX4500-40F-BF EX-48-AFL 
EX4500-40F-BF-C 

EX4500-40F-FB 

EX4500-40F-FB-C 


EX4550 EX4550-AFL 
EX6210 EX6210-AFL 
EX8208 EX8208-AFL 
EX8216 EX8216-AFL 
EX-XRE200 EX-XRE200-AFL 


EX9204 


EX9204-AFL 
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Table 83: Junos OS AFL Part Number on EX3200, EX4200, EX4500, EX4550, EX6200, EX8200, EX9200 
and EX9250 Switches (continued) 


Switch Model AFL Part Number 
EX9208 EX9208-AFL 
EX9214 EX9214-AFL 
EX9251 EX9251-AFL 
EX9251-ML 
EX9253 EX9253-AFL 
EX9253-ML 
EX9253-SFL 


You must download a MACsec feature license to enable MACsec. The MACsec feature license is an 
independent feature license; the enhanced feature licenses (EFLs) or advanced feature licenses (AFLs) that 
must be purchased to enable some features on EX Series switches cannot be purchased to enable MACsec. 


To purchase a feature license for MACsec, contact your Juniper Networks sales representative 
(https://www.juniper.net/us/en/contact-us/sales-offices). The Juniper sales representative will provide 
you with a feature license file and a license key. 


MACsec is supported on EX4200 and EX4550 switches. 


Table 68 on page 163 lists the MACsec model number that you can purchase for EX4200 and EX4550 
switch models. 


Table 84: Junos OS MACsec model number on EX4200 and EX4550 Switches 


Switch Model Model Number 
EX4550 EX-QFX-MACSEC-AGG 
EX4200 EX-QFX-MACSEC-ACC 


License Warning Messages 


For using features that require a license, you must install and configure a license key. To obtain a license 
key, use the contact information provided in your certificate. 
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If you have not purchased the AFL or EFL and installed the license key, you receive warnings when you 
try to commit the configuration: 


[edit protocols] 
Noyoio ! 
warning: requires 'bgp' license 


error: commit failed: (statements constraint check failed) 


The system generates system log (syslog) alarm messages notifying you that the feature requires a 
license—for example: 


Seo 8 WS3S9¢ iil craftd[806]: Minor alarm set, BGP Routing Protocol usage requires 
a license 


Se SF WSs S9¢ ili alarmd[805]: Alarm set: License color=YELLOW, class=CHASSIS, 








reason=BGP Routing Protocol usage requires a license 
Sepas US oot alarmd[805]: LICENSE_EXPIRED: License for feature bgp(47) expired 























Output of the show system alarms command displays the active alarms: 


user@switch> show system alarms 


1 alarm currently active 
Alarm time Class Description 


2009-09-03 06:00:11 UTC Minor BGP Routing Protocol usage requires a license 


Software Features That Require Licenses on EX Series Switches 


The following Junos OS features require an Enhanced Feature License (EFL) or Advanced Feature License 
(AFL) on EX Series devices: 


e (EX2200 only) Bidirectional forwarding detection (BFD) 

e (EX2200 only) Connectivity fault management (IEEE 802.lag) 

e (EX2200 only) Internet Group Management Protocol version 1 (IGMPv1), IGMPv2, and IGMPv3 
e (EX2200 and EX3300) OSPFv1/v2 (with 4 active interfaces) 


e (EX2200 only) Protocol Independent Multicast (PIM) dense mode, PIM source-specific mode, PIM sparse 
mode 


e (EX2200 and EX3300) Q-in-Q tunneling (IEEE 802.lad) 
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e (EX2200 only) Real-time performance monitoring (RPM) 


e (EX3200, EX4200, EX4500, EX6200, and EX8200) Border Gateway Protocol (BGP) and multiprotocol 
BGP (MBGP) 


e (EX3200, EX4200, EX4500, EX6200, and EX8200) Intermediate System-to-Intermediate System (IS-IS) 


e (EX3200, EX4200, EX4500, EX6200, and EX8200) IPvé protocols: OSPFv3, PIPng, IS-IS for IPvé, IPvé 
BGP 


e (EX3200, EX4200, EX4500, EX6200, and EX8200) MPLS with RSVP-based label-switched paths (LSPs) 
and MPLS-based circuit cross-connects (CCCs) 


For more details regarding EX Series feature licenses, see Understanding Software Licenses for EX Series 
Switches. 


For information about how to purchase a software license, contact your Juniper Networks sales 


representative at https://www.juniper.net/in/en/contact-us/. 


License Key Components for the EX Series Switch 


When you purchase a license for a Junos OS feature that requires a separate license, you receive a license 
key. 


A license key consists of two parts: 


e License ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, 
it is given a license ID. 


e License data—Block of binary data that defines and stores all license key objects. 


For example, in the following typical license key, the stringJunos204558 is the license ID, and the trailing 
block of data is the license data: 


XXXKKXKXKXKKK XXXXXK XXKXKXKXXKX XXKXKKK KXKXKXKXK XKXKXKXKK XKXKKKNK 
XXXXXX XXXXXX XXXXKXKX XXKXXXX XXXKKKX XXKXKXKK 
XXXXXX XXXXXX XXX 


The license data defines the device ID for which the license is valid and the version of the license. 


Managing Licenses for EX Series Switches (CLI Procedure) 


IN THIS SECTION 


@ Adding New Licenses | 180 
@ Deleting Licenses | 181 


@ Saving License Keys | 181 
@ Deleting Licenses | 181 


To enable and use some Junos OS features on an EX Series switch, you must purchase, install, and manage 
separate software licenses. Each switch requires one license. For a Virtual Chassis deployment, two licenses 
are recommended for redundancy. After you have configured the features, you see a warning message if 
the switch does not have a license for the feature. 


Before you begin managing licenses, be sure that you have: 


e Obtained the needed licenses. For information about how to purchase software licenses, contact your 
Juniper Networks sales representative. 


e Understand what makes up a license key. For more information, see “License Key Components for the 
EX Series Switch” on page 179. 


This topic includes the following tasks: 


Adding New Licenses 


To add one or more new license keys on the switch, with the CLI: 


1. Add the license key or keys: 


e To add one or more license keys from a file or URL, specify the filename of the file or the URL where 
the key is located: 


user@switch> request system license add filename | url 
e To add a license key from the terminal: 
user@switch> request system license add terminal 


2. When prompted, enter the license key, separating multiple license keys with a blank line. 


If the license key you enter is invalid, an error appears in the CLI output when you press Ctrl+d to exit 
the license entry mode. 
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Deleting Licenses 


To delete one or more license keys from the switch with the CLI, specify the license ID: 


user@switch> request system license delete license-id 


You can delete only one license at a time. 


Saving License Keys 


To save the installed license keys to a file (which can be a URL) or to the terminal: 


user@switch> request system license save filename | url 


For example, the following command saves the installed license keys to a file named license.conf: 
user@switch> request system license save ftp://user@switch/license.conf 

Deleting Licenses 

To delete one or more license keys from the switch with the CLI, specify the license ID: 


user@switch> request system license delete license-id 


You can delete only one license at a time. 


Monitoring Licenses for the EX Series Switches 


Displaying Installed Licenses and License Usage Details 


Purpose 


Verify that the expected license is installed and active on the switch and fully covers the switch 
configuration. 


Action 


From the CLI, enter the show system license command. (To display only the License usage list, enter the 
show system license usage command. To display only the Licenses installed output, enter show system 
license installed.) 


user@switch> show system license 


License usage: 





Licenses Licenses Licenses Expiry 


Feature name used installed needed 
bgp 1 i 0 
isis 0 1 0 
ospf3 0 i 0 
ripng 0 1 0 
mpls 0 il 0 








Licenses installed: 


License identifier: XXXXXXXXXX 








License version: 2 


Valid for device: XXXXXXXXXX 


Features: 





x—-series Licensed routing protocols in ex-series 


permanent 


Meaning 


The output shows the license or licenses (for Virtual Chassis deployments) installed on the switch and 


license usage. Verify the following information: 


e If a feature that requires a license is configured (used), a license is installed on the switch. The Licenses 


neededd column must show that no licenses are required. 


e The appropriate number of licenses is installed. Each switch requires one license. For a Virtual Chassis 


deployment, two licenses are recommended for redundancy. 
e The expected license is installed. 
Displaying Installed License Keys 


Purpose 


Verify that the expected license keys are installed on the switch. 


permanent 


permanent 


permanent 


permanent 


permanent 
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Action 


From the CLI, enter the show system license keys command. 


user@switch> show system license keys 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
RKXXKK XKMKKKX KRKXKKK KRKKMKK KKRRKKM KXMKKX 


XXXXXX XXXXXX XXX 


Meaning 


The output shows the license key or keys (for Virtual Chassis deployments) installed on the switch. Verify 
that each expected license key is present. 


| Licenses for QFX Series 


IN THIS SECTION 


Generating License Keys | 183 

Software Features That Require Licenses on the QFX Series | 185 
Disaggregated Software Features That Require Licenses on the QFX Series | 192 
Generating the License Keys for a QFabric System | 193 


Understanding Junos Fusion Licenses | 195 


Generating License Keys 


When you purchase a Junos OS software feature license for a device, you receive an e-mail containing an 
authorization code for the feature license from Juniper Networks. You can use the authorization code to 
generate a unique license key (a combination of the authorization code and the device's serial number) for 
the device, and then add the license key on the device. 


Before generating the license keys for a device: 


e Purchase the required licenses for the device. See “Software Features That Require Licenses on the QFX 
Series” on page 185 and “Disaggregated Software Features That Require Licenses on the QFX Series” on 
page 192. 
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e Note down the authorization code in the e-mail you received from Juniper Networks when you purchased 


the license. Determine the serial number of the device. For instructions, see Download and Activate 
Your Software 


To generate the license keys for a device: 


This procedure shows you how to generate license keys on a QFX Series device, but you can follow the 


same procedure for any device. 


1. 


In a browser, log in to the Juniper Networks License Management System at 
https://www.juniper.net/Icrs/license.do. 


The Manage Product Licenses page appears. 


To access the licensing site, you must have a service contract with Juniper Networks and an access 
account. If you need help obtaining an account, complete the registration form at the Juniper Networks 
website 

https://www.juniper.net/registration/Register.jsp . 


. On the Generate Licenses tab, select QFX Series Product from the drop-down list, and click Go. 


The Generate Licenses - QFX Series Product page appears. 


. In the Device Serial Number field, enter the serial number for the device. 


. In the Authorization Code field, enter the authorization code in the e-mail you received from Juniper 


Networks when you purchased the license. 


. (Optional) If you want to enter another authorization code for the same device, click Enter More 


Authorization Codes to display a new authorization code field. Enter the authorization code in this 
field. 


. Click Confirm. 


The Confirm License Information page appears, displaying a summary of the information you submitted 
to the License Management System. 


. Review the information to ensure everything is correct and then click Generate License. 


The Generate Licenses - QFX Series Product Devices page appears, displaying a summary of your 
license keys, including a link that displays the details of your new license keys. 


. Select the file format in which you want to obtain your new license keys. 


. Select the delivery method you want to use to obtain your new license keys. 
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To download the license keys: 
e Select the Download to this computer option button, and click OK. 
To e-mail the license keys: 


e Select the Send e-mail to e-mail ID option button, and click OK. 


SEE ALSO 


Software Features That Require Licenses on the QFX Series | 185 


Software Features That Require Licenses on the QFX Series 


The standard Junos OS software shipped on the hardware platform for QFX Series switches except the 
QFX5200-32C, includes a perpetual base license. This license is valid for the life of the hardware platform. 


You must purchase the perpetual base license on the disaggregated Junos OS feature licenses on the 
QFX5200-32C. See “Disaggregated Software Features That Require Licenses on the QFX Series” on 
page 192. 


For information regarding newer subscription based licenses, including platforms supported, see Flex 
Software Subscription Model. 


For information about how to purchase any software license, contact your Juniper Networks sales 
representative, or an approved Juniper Partner. 


Table 85 on page 185 lists the Junos OS features which require licenses on QFX5100, 
QFX5110-48S-AFI/AFO (DC), QFX5110-32Q-AFI/AFO (DC), QFX5120-48Y-AFI/AFO (DC), QFX5200-32C, 
QFX5210-64C and QFX10000 line of switches. 


Table 85: Software Features which Require Licenses on QFX5100, QFX5110-48S-AFI/AFO (DC), 
QFX5110-32Q-AFI/AFO (DC), QFX5120-48Y-AFI/AFO (DC), QFX5200-32C, QFX5210-64C and QFX10000 
line of switches. 


Base Features Premium Features Advanced Features 
Basic IPv6é BGP MPLS 

BFD Ethernet VPN MPLS-based CCC 
CFM (IEEE 802.1ag) IPvé for BGP/MBGP RSVP-based LSP 


Class of service (COS)/Policing/Shaping/Marking IS-IS Segment Routing 
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Table 85: Software Features which Require Licenses on QFX5100, QFX5110-48S-AFI/AFO (DC), 
QFX5110-32Q-AFI/AFO (DC), QFX5120-48Y-AFI/AFO (DC), QFX5200-32C, QFX5210-64C and QFX10000 
line of switches. (continued) 


Base Features Premium Features Advanced Features 
Filtering IS-IS for IPv6é 

IGMPv1/v2/v3 (includes IGMP Snooping) MBGP 

Junos Telemetry Interface OVSDB 

MC-LAG VRF(BGP) 

MLDv1/v2 VXLAN 

OSPFv2 

OSPFv3 


PIM-DM/SM/SSM 


PIMvé 


Q-in-Q tunneling (IEEE 802.1ad) 


RIPng 


RPM 


Timing - Boundary Clock 


Timing - Transparent Clock 


Unicast reverse-path forwarding(RPF) 


Virtual Chassis (VC) 


Applicable also for QFX5200-32C/48Y switches. 


Virtual Router 


VRRP 


VRRPv6é 
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Table 85: Software Features which Require Licenses on QFX5100, QFX5110-48S-AFI/AFO (DC), 
QFX5110-32Q-AFI/AFO (DC), QFX5120-48Y-AFI/AFO (DC), QFX5200-32C, QFX5210-64C and QFX10000 


line of switches. (continued) 


Base Features 


Zero Touch Provisioning (ZTP) 


Premium Features 


Advanced Features 


Table 86 on page 187 lists the Junos OS features which require licenses on QFX5120, QFX5200-48Y, 
QFX5210, QFX5200-32C-L, and QFX5220 switches. 


Table 86: Software Features which Require Licenses on QFX5120, QFX5200-48Y, QFX5210, 


QFX5200-32C-L, and QFX5220 switches. 


Base Features 


Basic IPv6 


BFD 


CFM (IEEE 802.1ag) 


Class of service (COS)/Policing/Shaping/Marking 


Filtering 


IGMPv1/v2/v3 (includes IGMP Snooping) 


Junos Telemetry Interface 


MLDv1/v2 


OSPFv2 


OSPFv3 


PIM-DM/SM/SSM 


PIMv6é 


Q-in-Q tunneling (IEEE 802.1ad) 


RIPng 


Premium Features 


BGP 


Ethernet VPN 


IPvé for BGP/MBGP 


IS-IS 


IS-IS for IPv6é 


MBGP 


OVSDB 


MC-LAG 


VXLAN 


Advanced Features 


MPLS 


MPLS-based CCC 


RSVP-based LSP 


Segment Routing 
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Table 86: Software Features which Require Licenses on QFX5120, QFX5200-48Y, QFX5210, 
QFX5200-32C-L, and QFX5220 switches. (continued) 


Base Features Premium Features Advanced Features 


RPM 


Timing - Boundary Clock 


Timing - Transparent Clock 


Unicast reverse-path forwarding(RPF) 


Virtual Chassis (VC) 


Except for QFX5200-32C/48Y 
switches. 


Virtual Router 


VRRP 


VRRPv6 


Zero Touch Provisioning (ZTP) 


If you try to configure a feature that is not licensed, you will receive syslog messages saying that you 
are using a feature that is licensable and that you do not possess a license for the feature. If you try to 
commit configuration changes for a feature that is not licensed, you will receive a commit warning saying 
that you have exceeded the allowed license limit for the feature. The feature will commit and be usable 
but this action violates EULA agreement. 


On QFX5100 and QFX5110, there is no separate license for Virtual Chassis like there is for Virtual 
Chassis Fabric. 


Premium Feature Licenses (PFL) include the Base License Features. Advanced Feature Licenses (AFL) 


include the Base and Premium License Features. 
Table 87 on page 188 describes the licenses required for QFX series switches: 
Table 87: Licenses Required for QFX Series Switches 


Number of Licenses QFX Devices 
Licence Description Required Supported 


Base Features included with the - - 
switch - No License required 


Table 87: Licenses Required for QFX Series Switches (continued) 


Licence 


QFX-JSL-EDGE-ADV1 


QFX5100-HDNSE-LIC 


QFX5K-C1-PFL 


QFX5K-C1-AFL 


QFX5K-C2-PFL 


QFX5K-C2-AFL 


QFX5000-35-JBS 


QFX5000-35-JPS 


QFX5000-35-JAS 


QFX10002-36Q-PFL 


QFX10002-36Q-AFL 


Description 


QFX Series Edge Advanced 
Feature License 


QFX5100-24Q and 
QFX5100-96S Advanced 
Feature License 


QFX5000 Class 1 Premium 
Feature License 


QFX5000 Class 1 Advanced 
Feature License 


QFX5000 Class 2 Premium 
Feature License 


QFX5000 Class 2 Advanced 
Feature License 


QFX5200-32C Base Services 
License 


QFX5200-32C Premium 
Services License 


QFX5200-32C Advanced 
Feature License 


QFX10002-36Q Premium 
Feature License 


QFX10002-36Q Advanced 
Feature License 


Number of Licenses 
Required 


One per switch, two per 
Virtual Chassis, and two 
per Virtual Chassis 
Fabric 


One per switch, two per 
Virtual Chassis, and two 
per Virtual Chassis 
Fabric 

One per switch, two per 
Virtual Chassis, and two 
per Virtual Chassis 
Fabric 

One per switch, two per 
Virtual Chassis, and two 
per Virtual Chassis 
Fabric 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


QFX Devices 
Supported 


QFX3500, QFX3600, 


QFX5100-48S, 
QFX5100-48T 


QFX5100-24Q , 
QFX5100-96S 


QFX5110-32Q, 
QFX5110-48S, 
QFX5120-48Y, 
QFX5200-48Y 
QFX5110-32Q, 
QFX5110-48S, 
QFX5120-48Y, 
QFX5200-48Y 


QFX5210-64C 


QFX5210-64C 


QFX5200-32C 


QFX5200-32C 


QFX5200-32C 


QFX10002-36Q 


QFX10002-36Q 
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Table 87: Licenses Required for QFX Series Switches (continued) 


Licence 


QFX10002-60C-PFL 


QFX10002-60C-AFL 


QFX10002-72Q-PFL 


QFX10002-72Q-AFL 


QFX10008-PFL 


QFX10008-AFL 


QFX10016-PFL 


QFX10016-AFL 


QFX-JSL-DRCTR-ADV1 


QFX-JSL-EDGE-FC 


QFX-JSL-DRCTR-FC 


QFX-JSL-DRCTR-FC-C16 


Description 


QFX10002-60C Premium 
Feature License 


QFX10002-60C Advanced 
Feature License 


QFX10002-72Q Premium 
Feature License 


QFX10002-72Q Advanced 
Feature License 


QFX10008 Premium Feature 
License 


QFX10008 Advanced Feature 
License 


QFX10016 Premium Feature 
License 


QFX10016 Advanced Feature 
License 


QFX Series Control Advanced 
feature license 1 


QFX Series Edge feature license 
for Fibre Channel 


QF&X Series Control Feature 
License for Fibre Channel 


QFX Series Control Feature 
License for Fibre Channel 
Capacity 16 


Number of Licenses 
Required 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per switch 


One per Node device in 


a network Node group 


One per switch on 


which fibre channel 


ports are configured 


One per QFX3500 


Node device on which 


fibre channel ports are 


configured 


One for up to 16 


QFX3500 Node devices 


on which fibre channel 
ports are configured 
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QFX Devices 


Supported 


QFX10002-60C 


QFX10002-60C 


QFX10002-72Q 


QFX10002-72Q 


QFX10008 


QFX10008 


QFX10016 


QFX10016 


QFX3100 Director 


device 


QFX3500 


QFX3100 Director 
device 


QFX3100 Director 
device 


Table 87: Licenses Required for QFX Series Switches (continued) 


Licence 


QFX3000-JSL-EDGE-FAB 


QFX3008-JSL-DRCTR-FAB 


QFX3000M-JSL-DRCTR-FAB 


EX-QFX-MACSEC-AGG 


QFX-VCF-LIC 


QFX10000-30C-LFIB 


QFX10000-36Q-LFIB 


QFX10000-60S-LFIB 


QFX10002-36Q-LFIB 


QFX10002-60C-LFIB 


Description 


QFX3000 Series QFabric /Node 
Feature License 


QFX3000-G Base Fabric 
Software 


QFX3000-M Base Fabric 
Software 


QFX and EX Series feature 
license for enabling Media 
Access Control security 
(MACsec). See Understanding 
Media Access Control Security 
(MACsec) 


Virtual Chassis Fabric (VCF) 
License for QFX5100 and 
QFX5110. 


1 Million (v4 or v6) Forwarding 
Information Base (FIB) entries 
license 


1 Million (v4 or v6) Forwarding 
Information Base (FIB) entries 
license 


1 Million (v4 or v6) Forwarding 
Information Base (FIB) entires 
license 


1 Million (v4 or v6) Forwarding 
Information Base (FIB) entries 
license 


1 Million (v4 or v6) Forwarding 
Information Base (FIB) entries 
license 


Number of Licenses 
Required 


One per device 


One per QFX3000-G 


QFabric system 


One per QFX3000-M 
QFabric system 


One per switch, two per 
Virtual Chassis 


Two per Virtual Chassis 


Fabric (VCF) 


One per line card 


One per line card 


One per line card 


One per switch 


One per switch 
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QFX Devices 
Supported 


QFX3100 Director 
device 


QFX3000-G 


QFX3000-M 


QFX switches that 
support MACsec 


QFX5100 and 
QFX5110. 


QFX10000-30C, 
QFX10000-30C-M line 
cards 


QFX10000-36Q, 
QFX10K-12C-DWDM 
line cards 


QFX10000-60S-6Q 
line card 


QFX10002 36-port 
A4OGbE QSFP+/12-port 
100GbE QSFP28 
switch 


QFX10002-60C 


Table 87: Licenses Required for QFX Series Switches (continued) 


Number of Licenses | QFX Devices 
Licence Description Required Supported 


QFX10002-72Q-LFIB 1 Million (v4 or v6) Forwarding One per switch QFX10002-72Q 
Information Base (FIB) entries 
license 


Disaggregated Software Features That Require Licenses on the QFX Series 


Disaggregated Software Feature Licenses on QFX5200 Switches 


The disaggregated software feature licenses are only applicable for QFX5200-32C devices. For 
QFX5200-48Y devices, the base software features are included with the device. Additional licenses are 


required only for premium and advanced features. 


For information on standard Junos OS feature licenses, see “Software Features That Require Licenses on 
the QFX Series” on page 185. 


The Junos OS software is disaggregated from the hardware. With disaggregated Junos OS, you can purchase 


the following feature licenses, which are available on a perpetual basis: 


Junos Base Software (JBS) license: 


Includes basic layer 2 switching, basic layer 3 routing, multicast, automation, programmability, Zero 
Touch Provisioning (ZTP) and basic monitoring. 


You must purchase the JBS license to use basic functions, but you do not need to install the license key 
in Junos OS Release 15.1X53-D30. JBS basic functions work with this release without installing the 
license key. However, you will need to install the license key in a future release of Junos OS to be 
determined, so make sure to retain the authorization code you received from the license portal to 
generate a license key for the JBS license. If the license is not installed, system triggers the log messages. 


The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, SRX Series, EX 
Series, NFX, vVBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, JSA, SBR Carrier, Screen 
OS and so on) access the License Management System (LMS). 


Junos Advanced Software (JAS) license: 


Includes features supported in JBS license and Border Gateway Protocol (BGP), Intermediate 
System-to-Intermediate System (IS-IS), and Virtual Extensible Local Area Network (VXLAN). You need 
to install the license key to use these features. 


Junos Premium Software (JPS) license: 


Includes features supported in JAS license and Multi-protocol Label Switching (MPLS) feature set. You 
need to install the license key to use these features. 
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For information about how to purchase a software feature license, contact your Juniper Networks sales 
representative. 


Table 88: Disaggregated Junos OS Feature Licenses and Associated SKU’s 


Licensed Software Features SKU’s 
Junos base software (JBS) license QFX5000-35-JBS 
Junos advanced software (JAS) license | QFX5000-35-JAS 


Junos premium software (JPS) license | QFX5000-35-JPS 


Generating the License Keys for a QFabric System 


When you purchase a Junos OS software feature license for a QFabric system, you receive an e-mail 
containing an authorization code for the feature license from Juniper Networks. You can use the 
authorization code to generate a unique license key (a combination of the authorization code and the 
QFabric system ID ) for the QFabric system, and then add the license key on the QFabric system. 


Before generating the license keys for a QFabric system: 


Purchase the required licenses for the QFabric system. See “Software Features That Require Licenses 
on the QFX Series” on page 185. 


Note down the authorization code in the e-mail you received from Juniper Networks when you purchased 
the license. 


Perform the initial setup of the QFabric system on the Director group. See Performing the QFabric System 
Initial Setup on a QFX3100 Director Group. 


Log in to the QFabric system, issue the show version command, and note down the software serial 
number and QFabric system ID for the QFabric system. 


user@qfabric> show version 


Hostname: qfabric 

Model: qfx3000-g 

Serial Number: qfsn—-0123456789 

QFabric System ID: £158527a-£99e-1le0-9fbd-O00e081c57cda 
JUNOS Base Version [12.2120111018 0215 dc-builder] 
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To generate the license keys for a QFabric system: 


1. 


In a browser, log in to the license portal. 


The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, SRX Series, 
EX Series, NFX, vVBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, JSA, SBR Carrier, 
Screen OS and so on) access the License Management System (LMS). 


The Manage Product Licenses page appears. 


To access the licensing site, you must have a service contract with Juniper Networks and an access 
account. If you need help obtaining an account, complete the registration form at the Juniper Networks 
website 

https://www.juniper.net/registration/Register.jsp . 


. On the Generate Licenses tab, select QFX Series Product from the drop-down list, and click Go. 


The Generate Licenses - QFX Series Product page appears. 


. Select the QFX Series Product Fabric option button, and then click Continue. 


The Generate Licenses - QFX Series Product Fabrics page appears. 


. In the Software Serial No field, enter the software serial number for the QFabric system. 


. In the QFabric System ID field, enter the QFabric system ID for the QFabric system. 


. In the Authorization Code field, enter the authorization code in the e-mail you received from Juniper 


Networks when you purchased the license. 


. (Optional) If you want to enter another authorization code for the same device, click Enter More 


Authorization Codes to display a new authorization code field. Enter the authorization code in this 
field. 


. Click Confirm. 


The Confirm License Information page appears, displaying a summary of the information you submitted 
to the license portal. 


. Review the information to ensure everything is correct and then click Generate License. 


The Generate Licenses - QFX Series Product Fabrics page appears, displaying a summary of your license 
keys, including a link that displays the details of your new license keys. 


10. Select the file format in which you want to obtain your new license keys. 


11. Select the delivery method you want to use to obtain your new license keys. 


To download the license keys: 
e Select the Download to this computer option button, and click OK. 
To e-mail the license keys: 


e Select the Send e-mail to e-mail ID option button, and click OK. 


SEE ALSO 


Performing the QFabric System Initial Setup on a QFX3100 Director Group 


show version 


Understanding Junos Fusion Licenses 


New deployments for Multichassis link aggregation groups (MC-LAG) or Ethernet VPN (EVPN) based Junos 
Fusion Data Center are not recommended. 


Starting with Junos OS Release 17.2R1, you need to install a Junos Fusion license in addition to any other 
feature licenses that you install to track and activate certain QFX5100-48SH and QFX5100-48TH models 
that are shipped with satellite software. These models can only be used as satellite devices. For these 
models, you need to install a Junos Fusion license in addition to any other feature licenses that you install. 
See Table 89 on page 196 for a list of satellite devices that require Junos Fusion licenses. 


You do not need Junos Fusion licenses for satellite device models that were purchased as Junos OS-based 
top-of-rack switches. 


Install the Junos Fusion licenses on the aggregation device because the aggregation device is the single 
point of management in a Junos Fusion. If your Junos Fusion is operating in a topology with multiple 
aggregation devices, you only need to install the licenses on one aggregation device because the license 
keys are synchronized between the two aggregation devices. 


You can install a single-pack license to activate one satellite device, or you can install multi-pack licenses, 
which can activate up to 128 satellite devices. If the number of satellite devices in a Junos Fusion exceeds 
the number of Junos Fusion licenses you have installed, the satellite devices are provisioned, but the system 
will issue a warning saying that there is a license limit violation. If the satellite device does not have a 
corresponding Junos Fusion license installed, the satellite device is provisioned, but the system will issue 
a warning. 


Table 89 on page 196 lists the supported aggregation and satellite devices as well as the model numbers 
of the Junos Fusion license packs. 
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For information about how to purchase a software license, contact your Juniper Networks sales 
representative. For information on standard Junos OS feature licenses, see “Software Features That Require 
Licenses on the QFX Series” on page 185. 


Table 89: Junos Fusion License Model Numbers for Satellite Devices 


Aggregation Devices Satellite Devices Requiring 

Supported Licenses Model Numbers of License Packs 
QFX10002, QFX10008 and ~=—s e« QFX5100-48SH-AFO QFX10K-C1-JFS-1 

QFX10016 switches e QFX5100-48SH-AFI 


QFX10K-C1-JFS-4 
e QFX5100-48TH-AFO 


© QFX5100-48TH-AFI QE CT IES-8 


QFX10K-C1-JFS-16 
QFX10K-C1-JFS-32 


QFX10K-C1-JFS-64 


SEE ALSO 


Generating License Keys | 183 


CHAPTER 5 


Licenses for Security Devices 


IN THIS CHAPTER 


Licenses for SRX Series | 197 
Managing Junos OS Licenses | 238 
Licenses for vSRX | 247 


Licenses for Advanced Threat Prevention | 276 


| Licenses for SRX Series 


IN THIS SECTION 


Software Feature Licenses for SRX Series Devices | 197 

Understanding Chassis Cluster Licensing Requirements | 226 

Installing Licenses on the SRX Series Devices in a Chassis Cluster | 227 

Verifying Licenses on an SRX Series Device in a Chassis Cluster | 230 

Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices | 232 
Understanding UTM Licensing | 233 

Installing the IPS License (CLI) | 235 


Installing and Verifying Licenses for an Application Signature Package | 236 


Software Feature Licenses for SRX Series Devices 


IN THIS SECTION 


Features Requiring a License on SRX100 and SRX110 Devices | 198 


Features Requiring a License on SRX210 Devices | 199 
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Features Requiring a License on SRX220 Devices | 201 
Features Requiring a License on SRX240 Devices | 202 
Features Requiring a License on SRX300 Devices | 203 
Features Requiring a License on SRX320 Devices | 205 
Features Requiring a License on SRX340 Devices | 205 
Features Requiring a License on SRX345 Devices | 206 
Features Requiring a License on SRX550 Devices | 207 
Features Requiring a License on SRX650 Devices | 210 
Features Requiring a License on SRX1400 Devices | 211 
Features Requiring a License on SRX1500 Devices | 212 
Features Requiring a License on SRX3400 Devices | 214 
Features Requiring a License on SRX3600 Devices | 215 
Features Requiring a License on SRX4100 Devices | 216 
Features Requiring a License on SRX4200 Devices | 217 
Features Requiring a License on SRX4600 Devices | 219 
Features Requiring a License on SRX5400 Devices | 221 
Features Requiring a License on SRX5600 Devices | 223 


Features Requiring a License on SRX5800 Devices | 225 


Each feature license is tied to exactly one software feature, and that license is valid for exactly one device. 
Each license allows you to run the specified advanced software features on a single device. Platform 
support depends on the Junos OS release in your installation. 


NOTE: To understand more about Junos OS Software Licensing, see the Juniper Licensing Guide. 
Please refer to the product Data Sheets accessible from Products & Services for details, or contact 
your Juniper Account Team or Juniper Partner. 


Sky Advanced Threat Prevention, ThreatFeed and Enhanced Web Filtering individual license are 
available. This is not a complete list of licenses. For the most up-to-date license models available, 
contact your Juniper Networks representative for license information. 


Features Requiring a License on SRX100 and SRX110 Devices 


Table 90 on page 199 lists the licenses you can purchase for each SRX Series software feature. 
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Table 90: SRX100 and SRX110 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention 
Signatures (1 year and 3 years subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Intrusion Detection and Prevention (1 year and 3 years 
subscription) 


Kaspersky antivirus (1 year and 3 years subscription) 


Kaspersky antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Websense Enhanced Web Filtering (1 year and 3 years 
subscription) 


Features Requiring a License on SRX210 Devices 


Supported Devices 


SRX100 


SRX110 


SRX100 


SRX100 


SRX100 


SRX100 


SRX110 


SRX100 


SRX110 
SRX100 
SRX110 
SRX100 
SRX110 


SRX100 


SRX110 
SRX100 


SRX110 


SRX100 


SRX110 
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Model Number 


SRX100-APPSEC-A-1 


SRX100-APPSEC-A-3 


SRX1XX-APPSEC-A-1 


SRX1XX-APPSEC-A-3 


SRX-RAC-5-LTU 


SRX-RAC-10-LTU 


SRX-RAC-25-LTU 


SRX1XX-IDP 


SRX1XX-IDP-3 


SRX1XX-K-AV 


SRX1XX-K-AV-3 


SRX1XX-SMB4-CS 


SRX1XX-SMB4-CS-3 


SRX1XX-S2-AS 


SRX1XX-S2-AS-3 


SRX1XX-S-AV 


SRX1XX-S-AV-3 


SRX1XX-S-SMB4-CS 


SRX1XX-S-SMB4-CS-3 


SRX1XX-W-EWF 


SRX1XX-W-EWF-3 


Table 91 on page 200 lists the licenses you can purchase for each SRX Series software feature. 


Table 91: SRX210 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention Signatures 


(1 year and 3 years subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Dynamic VPN (50 Concurrent users, PulseSecure) 


Dynamic VPN (100 Concurrent users, PulseSecure) 


Dynamic VPN (150 Concurrent users, PulseSecure) 


Dynamic VPN (250 Concurrent users, PulseSecure) 


Intrusion Detection and Prevention (1 year and 3 years 
subscription) 


Kaspersky antivirus (1 year and 3 years subscription) 


Kaspersky antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Supported 
Devices 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 


SRX210 
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Model Number 


SRX210-APPSEC-A-1 


SRX210-APPSEC-A-3 


SRX-RAC-5-LTU 


SRX-RAC-10-LTU 


SRX-RAC-25-LTU 


SRX-RAC-50-LTU 


SRX-RAC-100-LTU 


SRX-RAC-150-LTU 


SRX-RAC-250-LTU 


SRX210-IDP 


SRX210-IDP-3 


SRX210-K-AV 


SRX210-K-AV-3 


SRX210-SMB4-CS 


SRX210-SMB4-CS-3 


SRX210-S2-AS 


SRX210-S2-AS-3 


SRX210-S-AV 


SRX210-S-AV-3 


SRX210-S-SMB4-CS 


SRX210-S-SMB4-CS-3 
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Table 91: SRX210 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Websense Enhanced Web Filtering (1 year and 3 years SRX210 SRX210-W-EWF 


subscription) SRX210-W-EWF-3 


Features Requiring a License on SRX220 Devices 


Table 92 on page 201 lists the licenses you can purchase for each SRX Series software feature. 


Table 92: SRX220 Junos OS Feature License Model Number 


Supported 

Licensed Software Feature Devices Model Number 
Application Security and Intrusion Prevention Signatures | SRX220 SRX220-APPSEC-A-1 
(1 year and 3 years subscription) 

SRX220-APPSEC-A-3 
Dynamic VPN (5 Concurrent users, PulseSecure) SRX220 SRX-RAC-5-LTU 
Dynamic VPN (10 Concurrent users, PulseSecure) SRX220 SRX-RAC-10-LTU 
Dynamic VPN (25 Concurrent users, PulseSecure) SRX220 SRX-RAC-25-LTU 
Dynamic VPN (50 Concurrent users, PulseSecure) SRX220 SRX-RAC-50-LTU 
Dynamic VPN (100 Concurrent users, PulseSecure) SRX220 SRX-RAC-100-LTU 
Dynamic VPN (150 Concurrent users, PulseSecure) SRX220 SRX-RAC-150-LTU 
Dynamic VPN (250 Concurrent users, PulseSecure) SRX220 SRX-RAC-250-LTU 
Intrusion Detection and Prevention (1 year and 3 years SRX220 SRX220-IDP 
subscription) 

SRX220-IDP-3 
Kaspersky antivirus (1 year and 3 years subscription) SRX220 SRX220-K-AV 

SRX220-K-AV-3 
Kaspersky antivirus, Enhanced Web Filtering, Sophos SRX220 SRX220-SMB4-CS 


antispam, Application Security and Intrusion Detection 


and Prevention (1 year and 3 years subscription) SRX220-SMB4-CS-3 


Table 92: SRX220 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Websense Enhanced Web Filtering (1 year and 3 years 
subscription) 


Features Requiring a License on SRX240 Devices 


Supported 
Devices 


SRX220 


SRX220 


SRX220 


SRX220 
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Model Number 


SRX220-S2-AS 


SRX220-S2-AS-3 


SRX220-S-AV 


SRX220-S-AV-3 


SRX220-S-SMB4-CS 


SRX220-S-SMB4-CS-3 


SRX220-W-EWF 


SRX220-W-EWF-3 


Table 93 on page 202 lists the licenses you can purchase for each SRX Series software feature. 


Table 93: SRX240 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention Signatures 
(1 year and 3 years subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Dynamic VPN (50 Concurrent users, PulseSecure) 


Dynamic VPN (100 Concurrent users, PulseSecure) 


Dynamic VPN (150 Concurrent users, PulseSecure) 


Dynamic VPN (250 Concurrent users, PulseSecure) 


Supported 


Devices 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


Model Number 


SRX240-APPSEC-A-1 


SRX240-APPSEC-A-3 


SRX-RAC-5-LTU 


SRX-RAC-10-LTU 


SRX-RAC-25-LTU 


SRX-RAC-50-LTU 


SRX-RAC-100-LTU 


SRX-RAC-150-LTU 


SRX-RAC-250-LTU 


Table 93: SRX240 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Intrusion Detection and Prevention (1 year and 3 years 


subscription) 


Kaspersky antivirus (1 year and 3 years subscription) 


Kaspersky antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Websense Enhanced Web Filtering (1 year and 3 years 
subscription) 


Features Requiring a License on SRX300 Devices 


Supported 
Devices 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 


SRX240 
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Model Number 


SRX240-IDP 


SRX240-IDP-3 


SRX240-K-AV 


SRX240-K-AV-3 


SRX240-SMB4-CS 


SRX240-SMB4-CS-3 


SRX240-S2-AS 


SRX240-S2-AS-3 


SRX240-S-AV 


SRX240-S-AV-3 


SRX240-S-SMB4-CS 


SRX240-S-SMB4-CS-3 


SRX240-W-EWF 


SRX240-W-EWF-3 


Table 94 on page 203 lists the licenses you can purchase for each SRX Series software feature. 


Table 94: SRX300 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Detection and Prevention, 


Enhanced Web Filtering, Antivirus and Sky Advanced 
Threat Prevention (1 year, 3 years and 5 years 


subscription) 


Supported 


Devices 


SRX300 


Model Number 


SRX300-ATP-BUN-1 


SRX300-ATP-BUN-3 


Table 94: SRX300 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 
Application Security, Intrusion Prevention Signatures, 


Antivirus, Enhanced Web Filtering (1 year, 3 years and 5 
years subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Dynamic VPN (50 Concurrent users, PulseSecure) 


Dynamic VPN (100 Concurrent users, PulseSecure) 


Dynamic VPN (150 Concurrent users, PulseSecure) 


Dynamic VPN (250 Concurrent users, PulseSecure) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Intrusion Detection and Prevention (1 year, 3 years and 
5 years subscription) 


Remote Access (5 Concurrent users, NCP) 


Remote Access (10 Concurrent users, NCP) 


Remote Access (25 Concurrent users, NCP) 


Remote Access (50 Concurrent users, NCP) 


Remote Access (100 Concurrent users, NCP) 


Supported 
Devices 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 


SRX300 
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Model Number 


SRX300-CS-BUN-1 
SRX300-CS-BUN-3 


SRX300-CS-BUN-5 


SRX-RAC-5-LTU 


SRX-RAC-10-LTU 


SRX-RAC-25-LTU 


SRX-RAC-50-LTU 


SRX-RAC-100-LTU 


SRX-RAC-150-LTU 


SRX-RAC-250-LTU 


SRX300-W-EWF-1 
SRX300-W-EWF-3 


SRX300-W-EWF-5 


SRX300-IPS-1 
SRX300-IPS-3 


SRX300-IPS-5 


SRX-RA1-5 


SRX-RA1-10 


SRX-RA1-25 


SRX-RA1-50 


SRX-RA1-100 
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Table 94: SRX300 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Remote Access (150 Concurrent users, NCP) SRX300 SRX-RA1-150 
Remote Access (250 Concurrent users, NCP) SRX300 SRX-RA1-250 


Features Requiring a License on SRX320 Devices 


Table 95 on page 205 lists the licenses you can purchase for each SRX Series software feature. 


Table 95: SRX320 Junos OS Feature License Model Number 


Supported 
Licensed Software Feature Devices Model Number 
Application Security, Intrusion Detection and Prevention, _SRX320 SRX320-ATP-BUN-1 
Enhanced Web Filtering, Antivirus and Sky Advanced 
Threat Prevention (1 year and 3 years subscription) a 
Application Security, Intrusion Prevention Signatures, SRX320 SRX320-CS-BUN-1 
Antivirus, Enhanced Web Filtering (1 year, 3 years and 
ne SRX320-CS-BUN-3 

5 years subscription) 

SRX320-CS-BUN-5 
Enhanced Web Filtering (1 year, 3 years and 5 years SRX320 SRX320-W-EWF-1 
subscription) 

SRX320-W-EWF-3 

SRX320-W-EWF-5 
Intrusion Detection and Prevention (1 year, 3 years and | SRX320 SRX320-IPS-1 
5 years subscription) 

SRX320-IPS-3 

SRX320-IPS-5 


Features Requiring a License on SRX340 Devices 


Table 96 on page 206 lists the licenses you can purchase for each SRX Series software feature. 


Table 96: SRX340 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Detection and 
Prevention, Enhanced Web Filtering, Antivirus and Sky 
Advanced Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Antivirus, Enhanced Web Filtering (1 year and 3 years 


subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 


subscription) 


Intrusion Detection and Prevention (1 year, 3 years and 
5 years subscription) 


Sky Advanced Threat Prevention (1 year, 3 years and 
5 years subscription) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year and 3 years subscription) 


Features Requiring a License on SRX345 Devices 


Supported 
Devices 


SRX340 


SRX340 


SRX340 


SRX340 


SRX340 


SRX340 
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Model Number 


SRX340-ATP-BUN-1 


SRX340-ATP-BUN-3 


SRX340-ATP-BUN-5 


SRX340-CS-BUN-1 


SRX340-CS-BUN-3 


SRX340-CS-BUN-5 


SRX340-W-EWF-1 


SRX340-W-EWF-3 


SRX340-W-EWF-5 


SRX340-IPS-1 


SRX340-IPS-3 


SRX340-IPS-5 


SRX340-ATP-1 


SRX340-ATP-3 


SRX340-ATP-5 


SRX340-THRTFEED-1 


SRX340-THRTFEED-3 


SRX340-THRTFEED-5 


Table 97 on page 207 lists the licenses you can purchase for each SRX Series software feature. 


Table 97: SRX345 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Detection and 


Prevention, Enhanced Web Filtering, Antivirus and Sky 
Advanced Threat Prevention (1 year, 3 years and 5 years 


subscription) 


Application Security, Antispam, Intrusion Prevention 
Signatures, Antivirus, Enhanced Web Filtering (1 year 
and 3 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 


subscription) 


Intrusion Prevention Signature (1 year, 3 years and 5 
years subscription) 


Sky Advanced Threat Prevention (1 year, 3 years and 
5 years subscription) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year and 3 years subscription) 


Features Requiring a License on SRX550 Devices 


Supported 
Devices 


SRX345 


SRX345 


SRX345 


SRX345 


SRX345 


SRX345 
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Model Number 


SRX345-ATP-BUN-1 


SRX345-ATP-BUN-3 


SRX345-ATP-BUN-5 


SRX345-CS-BUN-1 


SRX345-CS-BUN-3 


SRX345-CS-BUN-5 


SRX345-W-EWF-1 


SRX345-W-EWF-3 


SRX345-W-EWF-5 


SRX345-IPS-1 


SRX345-IPS-3 


SRX345-IPS-5 


SRX345-ATP-1 


SRX345-ATP-3 


SRX345-ATP-5 


SRX345-THRTFEED-1 


SRX345-THRTFEED-3 


SRX345-THRTFEED-5 


Table 98 on page 208 lists the licenses you can purchase for each SRX Series software feature. 


Table 98: SRX550 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention Signature 


(1 year, 3 years and 5 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Dynamic VPN (50 Concurrent users, PulseSecure) 


Dynamic VPN (100 Concurrent users, PulseSecure) 


Dynamic VPN (150 Concurrent users, PulseSecure) 


Dynamic VPN (250 Concurrent users, PulseSecure) 


Dynamic VPN (500 Concurrent users, PulseSecure) 


Intrusion Detection and Prevention (1 year, 3 years and 


5 years subscription) 


Kaspersky antivirus (1 year, 3 years and 5 years 
subscription) 


Supported 
Devices 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 
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Model Number 


SRX550-APPSEC-A-1 


SRX550-APPSEC-A-3 


SRX550-APPSEC-A-5 


SRX550-W-EWF 


SRX550-W-EWF-3 


SRX500-W-EWF-5 


SRX-RAC-5-LTU 


SRX-RAC-10-LTU 


SRX-RAC-25-LTU 


SRX-RAC-50-LTU 


SRX-RAC-100-LTU 


SRX-RAC-150-LTU 


SRX-RAC-250-LTU 


SRX-RAC-500-LTU 


SRX550-IDP 


SRX550-IDP-3 


SRX550-IDP-5 


SRX550-K-AV 


SRX550-K-AV-3 


SRX550-K-AV-5 
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Table 98: SRX550 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 
Kaspersky antivirus, Enhanced Web Filtering, Sophos 


antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Remote Access (5 Concurrent users, NCP) 


Remote Access (10 Concurrent users, NCP) 


Remote Access (25 Concurrent users, NCP) 


Remote Access (50 Concurrent users, NCP) 


Remote Access (100 Concurrent users, NCP) 


Remote Access (150 Concurrent users, NCP) 


Remote Access (250 Concurrent users, NCP) 


Remote Access (500 Concurrent users, NCP) 


Remote Access (1000 Concurrent users, NCP) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year, 3 years and 5 years subscription) 


Sky Advanced Threat Prevention (1 year, 3 years and 5 
years subscription) 


Sophos antispam (1 year, 3 years and 5 years 
subscription) 


Supported 
Devices 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


SRX550 


Model Number 


SRX550-SMB4-CS 


SRX550-SMB4-CS-3 


SRX550-SMB4-CS-5 


SRX-RA1-5 


SRX-RA1-10 


SRX-RA1-25 


SRX-RA1-50 


SRX-RA1-100 


SRX-RA1-150 


SRX-RA1-250 


SRX-RA1-500 


SRX-RA1-1000 


SRX550-THRTFEED-1 


SRX550-THRTFEED-3 


SRX550-THRTFEED-5 


SRX550-ATP-1 


SRX550-ATP-3 


SRX550-ATP-5 


SRX550-S2-AS 


SRX550-S2-AS-3 


SRX550-S2-AS-5 
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Table 98: SRX550 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year, 3 years and 5 years subscription) 


Features Requiring a License on SRX650 Devices 


Supported 

Devices Model Number 

SRX550 SRX550-S-AV 
SRX550-S-AV-3 
SRX550-S-AV-5 

SRX550 SRX550-S-SMB4-CS 


SRX550-S-SMB4-CS-3 


SRX550-S-SMB4-CS-5 


Table 99 on page 210 lists the licenses you can purchase for each SRX Series software feature. 


Table 99: SRX650 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention Signature 
(1 year and 3 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 


subscription) 


Dynamic VPN (5 Concurrent users, PulseSecure) 


Dynamic VPN (10 Concurrent users, PulseSecure) 


Dynamic VPN (25 Concurrent users, PulseSecure) 


Dynamic VPN (50 Concurrent users, PulseSecure) 


Dynamic VPN (100 Concurrent users, PulseSecure) 


Dynamic VPN (150 Concurrent users, PulseSecure) 


Dynamic VPN (250 Concurrent users, PulseSecure) 


Dynamic VPN (500 Concurrent users, PulseSecure) 


Supported 
Devices Model Number 
SRX650 SRX650-APPSEC-A-1 
SRX650-APPSEC-A-3 
SRX650 SRX650-W-EWF 
SRX650-W-EWF-3 
SRX650 SRX-RAC-5-LTU 
SRX650 SRX-RAC-10-LTU 
SRX650 SRX-RAC-25-LTU 
SRX650 SRX-RAC-50-LTU 
SRX650 SRX-RAC-100-LTU 
SRX650 SRX-RAC-150-LTU 
SRX650 SRX-RAC-250-LTU 
SRX650 SRX-RAC-500-LTU 


Table 99: SRX650 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Intrusion Detection and Prevention (1 year and 3 years 


subscription) 


Kaspersky antivirus (1 year and 3 years subscription) 


Kaspersky antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


Sophos antivirus, Enhanced Web Filtering, Sophos 
antispam, Application Security and Intrusion Detection 
and Prevention (1 year and 3 years subscription) 


Features Requiring a License on SRX1400 Devices 


Supported 
Devices 


SRX650 


SRX650 


SRX650 


SRX650 


SRX650 


SRX650 
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Model Number 


SRX650-IDP 


SRX650-IDP-3 


SRX650-K-AV 


SRX650-K-AV-3 


SRX650-SMB4-CS 


SRX650-SMB4-CS-3 


SRX650-S2-AS 


SRX650-S2-AS-3 


SRX650-S-AV 


SRX650-S-AV-3 


SRX650-S-SMB4-CS 


SRX650-S-SMB4-CS-3 


Table 100 on page 211 lists the licenses you can purchase for each SRX Series software feature. 


Table 100: SRX1400 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security and Intrusion Prevention Signature 
(1 year and 3 years subscription) 


Application Security, Intrusion Detection and 
Prevention, Enhanced Web Filtering, Antivirus and 
Antispam (1 year and 3 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Supported 
Devices 


SRX1400 


SRX1400 


SRX1400 


Model Number 


SRX1400-APPSEC-A-1 


SRX1400-APPSEC-A-3 


SRX1400-CS-BUN-1 


SRX1400-CS-BUN-3 


SRX1400-W-EWF-1 


SRX1400-W-EWF-3 
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Table 100: SRX1400 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Intrusion Detection and Prevention (1 year and 3 years 
subscription) 


Sophos antispam (1 year and 3 years subscription) 


Sophos antivirus (1 year and 3 years subscription) 


SRX Content Security (1 Incremental Logical Systems 
License for NetSecure) 


Features Requiring a License on SRX1500 Devices 


Supported 
Devices 


SRX1400 


SRX1400 


SRX1400 


SRX1400 


Model Number 


SRX1400-IDP 


SRX1400-IDP-3 


SRX1400-S-AS-1 


SRX1400-S-AS-3 


SRX1400-S-AV-1 


SRX1400-S-AV-3 


SRX-1400-LSYS-1 


Table 101 on page 212 lists the licenses you can purchase for each SRX Series software feature. 


Table 101: SRX1500 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Antispam, Intrusion Detection and 
Prevention, Enhanced Web Filtering, Antivirus and Sky 
Advanced Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Detection and 
Prevention, Enhanced Web Filtering, and Avira antivirus 
(1 year, 3 years and 5 years subscription) 


Application Security, Antispam, Intrusion Prevention 
Signatures, Antivirus, Enhanced Web Filtering (1 year, 
3 years and 5 years subscription) 


Supported 
Devices 


SRX1500 


SRX1500 


SRX1500 


Model Number 


SRX1500-ATP-BUN-1 


SRX1500-ATP-BUN-3 


SRX1500-ATP-BUN-5 


SRX1500-A-BUN-1 


SRX1500-A-BUN-3 


SRX1500-A-BUN-5 


SRX1500-CS-BUN-1 


SRX1500-CS-BUN-3 


SRX1500-CS-BUN-5 
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Table 101: SRX1500 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Intrusion Prevention Signature (1 year, 3 years and 5 
years subscription) 


Logical System License (1, 5, and 25 Incremental) 


Remote Access (5 Concurrent users, NCP) 


Remote Access (10 Concurrent users, NCP) 


Remote Access (25 Concurrent users, NCP) 


Remote Access (50 Concurrent users, NCP) 


Remote Access (100 Concurrent users, NCP) 


Remote Access (150 Concurrent users, NCP) 


Remote Access (250 Concurrent users, NCP) 


Remote Access (500 Concurrent users, NCP) 


Remote Access (1000 Concurrent users, NCP) 


Remote Access (2000 Concurrent users, NCP) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year, 3 years and 5 years subscription) 


Supported 
Devices 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


SRX1500 


Model Number 


SRX1500-W-EWF-1 


SRX1500-W-EWF-3 


SRX1500-W-EWF-5 


SRX1500-IPS-1 


SRX1500-IPS-3 


SRX1500-IPS-5 


SRX-1500-LSYS-1 


SRX-1500-LSYS-5 


SRX-1500-LSYS-25 


SRX-RA1-5 


SRX-RA1-10 


SRX-RA1-25 


SRX-RA1-50 


SRX-RA1-100 


SRX-RA1-150 


SRX-RA1-250 


SRX-RA1-500 


SRX-RA1-1000 


SRX-RA1-2000 


SRX1500-THRTFEED-1 


SRX1500-THRTFEED-3 


SRX1500-THRTFEED-5 
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Table 101: SRX1500 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Sky Advanced Threat Protection (1 year, 3 years and5 | SRX1500 


years subscription) 


Features Requiring a License on SRX3400 Devices 


Supported 
Devices 


Model Number 


SRX1500-ATP-1 


SRX1500-ATP-3 


SRX1500-ATP-5 


Table 102 on page 214 lists the licenses you can purchase for each SRX Series software feature. 


Table 102: SRX3400 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Detection and 
Prevention, Enhanced Web Filtering, Antivirus and Sky 
Advanced Threat Prevention (1 year and 3 year 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Antivirus, Enhanced Web Filtering (1 year and 3 years 
subscription) 


Application Security and Intrusion Prevention Signature 
(1 year and 3 year subscription) 


Enhanced Web Filtering (1 year and 3 years 
subscription) 


Intrusion Detection and Prevention (1 year and 3 years 
subscription) 


Logical System License (1, 5, and 25 Incremental) 


Supported 


Devices 


SRX3400 


SRX3400 


SRX3400 


SRX3400 


SRX3400 


SRX3400 


Model Number 


SRX3400-ATP-BUN-1 


SRX3400-ATP-BUN-3 


SRX3400-ATP-BUN-5 


SRX3400-CS-BUN-1 


SRX3400-CS-BUN-3 


SRX3400-APPSEC-A-1 


SRX3400-APPSEC-A-3 


SRX3400-W-EWF-1 


SRX3400-W-EWF-3 


SRX3K-IDP 


SRX3K-IDP-3 


SRX-3400-LSYS-1 


SRX-3400-LSYS-5 


SRX-3400-LSYS-25 


215 


Table 102: SRX3400 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Sophos antispam (1 year and 3 year subscription) SRX3400 SRX3400-S-AS-1 
SRX3400-S-AS-3 
Sophos antivirus (1 year and 3 year subscription) SRX3400 SRX3400-S-AV-1 


SRX3400-S-AV-3 


Features Requiring a License on SRX3600 Devices 


Table 103 on page 215 lists the licenses you can purchase for each SRX Series software feature. 


Table 103: SRX3600 Junos OS Feature License Model Number 


Supported 
Licensed Software Feature Devices Model Number 
Application Security, Intrusion Prevention Signatures, |. SRX3600 SRX3600-CS-BUN-1 
Antivirus, Enhanced Web Filtering (1 year and 3 years 
ae SRX3600-CS-BUN-3 

subscription) 
Application Security and Intrusion Prevention SRX3600 SRX3600-APPSEC-A-1 
Signature (1 year and 3 year subscription) 

SRX3600-APPSEC-A-3 
Enhanced Web Filtering (1 year and 3 years SRX3600 SRX3600-W-EWF-1 
subscription) 

SRX3600-W-EWF-3 
Intrusion Detection and Prevention (1 year and 3 SRX3600 SRX3K-IDP 
years subscription) 

SRX3K-IDP-3 
Logical System License (1, 5, and 25 Incremental) SRX3600 SRX-3600-LSYS-1 

SRX-3600-LSYS-5 

SRX-3600-LSYS-25 
Sophos antispam (1 year and 3 year subscription) SRX3600 SRX3600-S-AS-1 


SRX3600-S-AS-3 
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Table 103: SRX3600 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices 
Sophos antivirus (1 year and 3 year subscription) SRX3600 


Features Requiring a License on SRX4100 Devices 


Model Number 


SRX3600-S-AV-1 


SRX3600-S-AV-3 


Table 104 on page 216 lists the licenses you can purchase for each SRX Series software feature. 


Table 104: SRX4100 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Sky Advanced 
Threat Prevention (1 year, 3 years and 5 years 


subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 year, 


3 years and 5 years subscription) 


Application Security, Intrusion Detection and Prevention, 
Enhanced Web Filtering, and Avira antivirus (1 year, 3 
years and 5 years subscription) 


Enhanced performance (upgrade to firewall IMIX 
performance up to 20G IMIX to the base 20G IMIX 
firewall throughput supported and application security) 


Enhanced Web Filtering (1 year, 3 years and 5 years 


subscription) 


Intrusion Prevention Signature (1 year, 3 years and 5 
years subscription) 


Supported 


Devices 


SRX4100 


SRX4100 


SRX4100 


SRX4100 


SRX4100 


SRX4100 


Model Number 


SRX4100-ATP-BUN-1 


SRX4100-ATP-BUN-3 


SRX4100-ATP-BUN-5 


SRX4100-CS-BUN-1 


SRX4100-CS-BUN-3 


SRX4100-CS-BUN-5 


SRX4100-A-BUN-1 


SRX4100-A-BUN-3 


SRX4100-A-BUN-5 


SRX4100-E-P-UPG 


SRX4100-W-EWF-1 


SRX4100-W-EWF-3 


SRX4100-W-EWF-5 


SRX4100-IPS-1 


SRX4100-IPS-3 


SRX4100-IPS-5 
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Table 104: SRX4100 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Logical System License (1, 5, and 25 Incremental) SRX4100 SRX-4100-LSYS-1 
SRX-4100-LSYS-5 
SRX-4100-LSYS-25 
Remote Access (5 Concurrent users, NCP) SRX4100 SRX-RA1-5 
Remote Access (10 Concurrent users, NCP) SRX4100 SRX-RA1-10 
Remote Access (25 Concurrent users, NCP) SRX4100 SRX-RA1-25 
Remote Access (50 Concurrent users, NCP) SRX4100 SRX-RA1-50 
Remote Access (100 Concurrent users, NCP) SRX4100 SRX-RA1-100 
Remote Access (150 Concurrent users, NCP) SRX4100 SRX-RA1-150 
Remote Access (250 Concurrent users, NCP) SRX4100 SRX-RA1-250 
Remote Access (500 Concurrent users, NCP) SRX4100 SRX-RA1-500 
Remote Access (1000 Concurrent users, NCP) SRX4100 SRX-RA1-1000 
Remote Access (2000 Concurrent users, NCP) SRX4100 SRX-RA1-2000 
Remote Access (5000 Concurrent users, NCP) SRX4100 SRX-RA1-5000 
Sky Advanced Threat Prevention Threat Intelligence SRX4100 SRX4100-THRTFEED-1 
Feeds only (1 year, 3 years and 5 years subscription) 
SRX4100-THRTFEED-3 
SRX4100-THRTFEED-5 
Sky Advanced Threat Protection (1 year, 3 yearsand5 © SRX4100 SRX4100-ATP-1 


years subscription) 
SRX4100-ATP-3 


SRX4100-ATP-5 


Features Requiring a License on SRX4200 Devices 


Table 105 on page 218 lists the licenses you can purchase for each SRX Series software feature. 


Table 105: SRX4200 Junos OS Feature License Model Number 


Licensed Software Feature 
Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Sky Advanced 


Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 
year, 3 years and 5 years subscription) 


Application Security, Intrusion Detection and 
Prevention, Enhanced Web Filtering, and Avira antivirus 
(1 year, 3 years and 5 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Intrusion Prevention Signature (1 year, 3 years and 5 
years subscription) 


Logical System License (1, 5, and 25 Incremental) 


Remote Access (5 Concurrent users, NCP) 


Remote Access (10 Concurrent users, NCP) 


Remote Access (25 Concurrent users, NCP) 


Remote Access (50 Concurrent users, NCP) 


Remote Access (100 Concurrent users, NCP) 


Supported 
Devices 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 


SRX4200 
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Model Number 


SRX4200-ATP-BUN-1 


SRX4200-ATP-BUN-3 


SRX4200-ATP-BUN-5 


SRX4200-CS-BUN-1 


SRX4200-CS-BUN-3 


SRX4200-CS-BUN-5 


SRX4200-A-BUN-1 


SRX4200-A-BUN-3 


SRX4200-A-BUN-5 


SRX4200-W-EWF-1 


SRX4200-W-EWF-3 


SRX4200-W-EWF-5 


SRX4200-IPS-1 


SRX4200-IPS-3 


SRX4200-IPS-5 


SRX-4200-LSYS-1 


SRX-4200-LSYS-5 


SRX-4200-LSYS-25 


SRX-RA1-5 


SRX-RA1-10 


SRX-RA1-25 


SRX-RA1-50 


SRX-RA1-100 
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Table 105: SRX4200 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Remote Access (150 Concurrent users, NCP) 


Remote Access (250 Concurrent users, NCP) 


Remote Access (500 Concurrent users, NCP) 


Remote Access (1000 Concurrent users, NCP) 


Remote Access (2000 Concurrent users, NCP) 


Remote Access (5000 Concurrent users, NCP) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year, 3 years and 5 years subscription) 


Sky Advanced Threat Protection (1 year, 3 years and 5 
years subscription) 


Features Requiring a License on SRX4600 Devices 


Supported 
Devices Model Number 
SRX4200 SRX-RA1-150 
SRX4200 SRX-RA1-250 
SRX4200 SRX-RA1-500 
SRX4200 SRX-RA1-1000 
SRX4200 SRX-RA1-2000 
SRX4200 SRX-RA1-5000 
SRX4200 SRX4200-THRTFEED-1 
SRX4200-THRTFEED-3 
SRX4200-THRTFEED-5 
SRX4200 SRX4200-ATP-1 


SRX4200-ATP-3 


SRX4200-ATP-5 


Table 106 on page 219 lists the licenses you can purchase for each SRX Series software feature. 


Table 106: SRX4600 Junos OS Feature License Model Number 


Licensed Software Feature 


Intrusion Prevention Signatures, Enhanced Web 
Filtering, Antivirus and Sky Advanced Threat Prevention 
(1 year, 3 years and 5 years subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 
year, 3 years and 5 years subscription) 


Supported 

Devices Model Number 

SRX4600 SRX4600-ATP-BUN-1 
SRX4600-ATP-BUN-3 
SRX4600-ATP-BUN-5 

SRX4600 SRX4600-CS-BUN-1 


SRX4600-CS-BUN-3 


SRX4600-CS-BUN-5 
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Table 106: SRX4600 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Application Security, Intrusion Detection and SRX4600 SRX4600-A-BUN-1 
Prevention, Enhanced Web Filtering, and Avira antivirus 
a SRX4600-A-BUN-3 

(1 year, 3 years and 5 years subscription) 

SRX4600-A-BUN-5 
Enhanced Web Filtering (1 year, 3 years and 5 years SRX4600 SRX4600-W-EWF-1 
subscription) 

SRX4600-W-EWF-3 

SRX4600-W-EWF-5 
Intrusion Prevention Signature (1 year, 3 years and 5 SRX4600 SRX4600-IPS-1 
years subscription) 

SRX4600-IPS-3 

SRX4600-IPS-5 
Logical System License (1, 5, and 25 Incremental) SRX4600 SRX-4600-LSYS-1 

SRX-4600-LSYS-5 

SRX-4600-LSYS-25 
Remote Access (5 Concurrent users, NCP) SRX4600 SRX-RA1-5 
Remote Access (10 Concurrent users, NCP) SRX4600 SRX-RA1-10 
Remote Access (25 Concurrent users, NCP) SRX4600 SRX-RA1-25 
Remote Access (50 Concurrent users, NCP) SRX4600 SRX-RA1-50 
Remote Access (100 Concurrent users, NCP) SRX4600 SRX-RA1-100 
Remote Access (150 Concurrent users, NCP) SRX4600 SRX-RA1-150 
Remote Access (250 Concurrent users, NCP) SRX4600 SRX-RA1-250 
Remote Access (500 Concurrent users, NCP) SRX4600 SRX-RA1-500 
Remote Access (1000 Concurrent users, NCP) SRX4600 SRX-RA1-1000 


Remote Access (2000 Concurrent users, NCP) SRX4600 SRX-RA1-2000 
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Table 106: SRX4600 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Remote Access (5000 Concurrent users, NCP) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year, 3 years and 5 years subscription) 


Sky Advanced Threat Protection (1 year, 3 years and 5 
years subscription) 


Features Requiring a License on SRX5400 Devices 


Supported 
Devices 


SRX4600 


SRX4600 


SRX4600 


Model Number 


SRX-RA1-5000 


SRX4600-THRTFEED-1 


SRX4600-THRTFEED-3 


SRX4600-THRTFEED-5 


SRX4600-ATP-1 


SRX4600-ATP-3 


SRX4600-ATP-5 


Table 107 on page 221 lists the licenses you can purchase for each SRX Series software feature. 


Table 107: SRX5400 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Sky Advanced 
Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 
year, 3 years and 5 years subscription) 


Application Security and Intrusion Prevention Signature 
(1 year, 3 years and 5 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Supported 
Devices 


SRX5400 


SRX5400 


SRX5400 


SRX5400 


Model Number 


SRX5400-ATP-BUN-1 


SRX5400-ATP-BUN-3 


SRX5400-ATP-BUN-5 


SRX5400-CS-BUN-1 


SRX5400-CS-BUN-3 


SRX5400-CS-BUN-5 


SRX5400-APPSEC-1 


SRX5400-APPSEC-3 


SRX5400-APPSEC-5 


SRX5400-W-EWF-1 


SRX5400-W-EWF-3 


SRX5400-W-EWF-5 
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Table 107: SRX5400 Junos OS Feature License Model Number (continued) 


Supported 

Licensed Software Feature Devices Model Number 
Intrusion Detection and Prevention (1 year, 3 years and | SRX5400 SRX5K-IDP 
5 years subscription) 

SRX5K-IDP-3 

SRX5K-IDP-5 
Logical System License (1, 5, and 25 Incremental) SRX5400 SRX-5400-LSYS-1 

SRX-5400-LSYS-5 

SRX-5400-LSYS-25 
Remote Access (5 Concurrent users, NCP) SRX5400 SRX-RA1-5 
Remote Access (10 Concurrent users, NCP) SRX5400 SRX-RA1-10 
Remote Access (25 Concurrent users, NCP) SRX5400 SRX-RA1-25 
Remote Access (50 Concurrent users, NCP) SRX5400 SRX-RA1-50 
Remote Access (100 Concurrent users, NCP) SRX5400 SRX-RA1-100 
Remote Access (150 Concurrent users, NCP) SRX5400 SRX-RA1-150 
Remote Access (250 Concurrent users, NCP) SRX5400 SRX-RA1-250 
Remote Access (500 Concurrent users, NCP) SRX5400 SRX-RA1-500 
Remote Access (1000 Concurrent users, NCP) SRX5400 SRX-RA1-1000 
Remote Access (2000 Concurrent users, NCP) SRX5400 SRX-RA1-2000 
Remote Access (5000 Concurrent users, NCP) SRX5400 SRX-RA1-5000 
Remote Access (10K Concurrent users, NCP) SRX5400 SRX-RA1-10000 
Sky Advanced Threat Prevention Threat Intelligence SRX5400 SRX5400-THRTFEED-1 


Feeds only (1 year, 3 years and 5 years subscription) 
SRX5400-THRTFEED-3 


SRX5400-THRTFEED-5 
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Table 107: SRX5400 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Sky Advanced Threat Protection (1 year, 3 years and 
5 years subscription) 


Features Requiring a License on SRX5600 Devices 


Supported 


Devices 


SRX5400 


Model Number 


SRX5400-ATP-1 


SRX5400-ATP-3 


SRX5400-ATP-5 


Table 108 on page 223 lists the licenses you can purchase for each SRX Series software feature. 


Table 108: SRX5600 Junos OS Feature License Model Number 


Licensed Software Feature 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Sky Advanced 
Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 
year, 3 years and 5 years subscription) 


Application Security and Intrusion Prevention Signature 
(1 year, 3 years and 5 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Intrusion Detection and Prevention (1 year, 3 years 
and 5 years subscription) 


Supported 
Devices 


SRX5600 


SRX5600 


SRX5600 


SRX5600 


SRX5600 


Model Number 


SRX5600-ATP-BUN-1 


SRX5600-ATP-BUN-3 


SRX5600-ATP-BUN-5 


SRX5600-CS-BUN-1 


SRX5600-CS-BUN-3 


SRX5600-CS-BUN-5 


SRX5600-APPSEC-A-1 


SRX5600-APPSEC-A-3 


SRX5600-APPSEC-A-5 


SRX5600-W-EWF-1 


SRX5600-W-EWF-3 


SRX5600-W-EWF-5 


SRX5K-IDP 


SRX5K-IDP-3 


SRX5K-IDP-5 
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Table 108: SRX5600 Junos OS Feature License Model Number (continued) 


Supported 
Licensed Software Feature Devices Model Number 
Logical System License (1, 5, and 25 Incremental) SRX5600 SRX-5600-LSYS-1 
SRX-5600-LSYS-5 
SRX-5600-LSYS-25 
Remote Access (5 Concurrent users, NCP) SRX5600 SRX-RA1-5 
Remote Access (10 Concurrent users, NCP) SRX5600 SRX-RA1-10 
Remote Access (25 Concurrent users, NCP) SRX5600 SRX-RA1-25 
Remote Access (50 Concurrent users, NCP) SRX5600 SRX-RA1-50 
Remote Access (100 Concurrent users, NCP) SRX5600 SRX-RA1-100 
Remote Access (150 Concurrent users, NCP) SRX5600 SRX-RA1-150 
Remote Access (250 Concurrent users, NCP) SRX5600 SRX-RA1-250 
Remote Access (500 Concurrent users, NCP) SRX5600 SRX-RA1-500 
Remote Access (1000 Concurrent users, NCP) SRX5600 SRX-RA1-1000 
Remote Access (2000 Concurrent users, NCP) SRX5600 SRX-RA1-2000 
Remote Access (5000 Concurrent users, NCP) SRX5600 SRX-RA1-5000 
Remote Access (10K Concurrent users, NCP) SRX5600 SRX-RA1-10000 
Sky Advanced Threat Prevention Threat Intelligence SRX5600 SRX5600-THRTFEED-1 
Feeds only (1 year, 3 years and 5 years subscription) 
SRX5600-THRTFEED-3 
SRX5600-THRTFEED-5 
Sky Advanced Threat Protection (1 year, 3 years and SRX5600 SRX5600-ATP-1 


5 years subscription) 
SRX5600-ATP-3 


SRX5600-ATP-5 


Features Requiring a License on SRX5800 Devices 
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Table 109 on page 225 lists the licenses you can purchase for each SRX Series software feature. 


Table 109: SRX5800 Junos OS Feature License Model Number 


Licensed Software Feature 
Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Sky Advanced 


Threat Prevention (1 year, 3 years and 5 years 
subscription) 


Application Security, Intrusion Prevention Signatures, 
Enhanced Web Filtering, Antivirus and Antispam (1 
year, 3 years and 5 years subscription) 


Application Security and Intrusion Prevention Signature 
(1 year, 3 years and 5 years subscription) 


Enhanced Web Filtering (1 year, 3 years and 5 years 
subscription) 


Intrusion Detection and Prevention (1 year, 3 years 
and 5 years subscription) 


Logical System License (1, 5, and 25 Incremental) 


Remote Access (5 Concurrent users, NCP) 


Remote Access (10 Concurrent users, NCP) 


Remote Access (25 Concurrent users, NCP) 


Supported 
Devices 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


Model Number 


SRX5800-ATP-BUN-1 


SRX5800-ATP-BUN-3 


SRX5800-ATP-BUN-5 


SRX5800-CS-BUN-1 


SRX5800-CS-BUN-3 


SRX5800-CS-BUN-5 


SRX5800-APPSEC-A-1 


SRX5800-APPSEC-A-3 


SRX5800-APPSEC-A-5 


SRX5800-W-EWF-1 


SRX5800-W-EWF-3 


SRX5800-W-EWF-5 


SRX5K-IDP 


SRX5K-IDP-3 


SRX5K-IDP-5 


SRX-5800-LSYS-1 


SRX-5800-LSYS-5 


SRX-5800-LSYS-25 


SRX-RA1-5 


SRX-RA1-10 


SRX-RA1-25 
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Table 109: SRX5800 Junos OS Feature License Model Number (continued) 


Licensed Software Feature 


Remote Access (50 Concurrent users, NCP) 


Remote Access (100 Concurrent users, NCP) 


Remote Access (150 Concurrent users, NCP) 


Remote Access (250 Concurrent users, NCP) 


Remote Access (500 Concurrent users, NCP) 


Remote Access (1000 Concurrent users, NCP) 


Remote Access (2000 Concurrent users, NCP) 


Remote Access (5000 Concurrent users, NCP) 


Remote Access (10K Concurrent users, NCP) 


Sky Advanced Threat Prevention Threat Intelligence 
Feeds only (1 year, 3 years and 5 years subscription) 


Sky Advanced Threat Protection (1 year, 3 years and 
5 years subscription) 


SEE ALSO 


Supported 
Devices 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


SRX5800 


Model Number 


SRX-RA1-50 


SRX-RA1-100 


SRX-RA1-150 


SRX-RA1-250 


SRX-RA1-500 


SRX-RA1-1000 


SRX-RA1-2000 


SRX-RA1-5000 


SRX-RA1-10000 


SRX5800-THRTFEED-1 


SRX5800-THRTFEED-3 


SRX5800-THRTFEED-5 


SRX5800-ATP-1 


SRX5800-ATP-3 


SRX5800-ATP-5 


Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices 


Understanding Chassis Cluster Licensing Requirements 


There is no separate license required for chassis cluster. However, some Junos OS software features 


require a license to activate the feature. To configure and use the licensed feature in a chassis cluster 


setup, you must purchase one license per feature per device and the license needs to be installed on both 


227 


nodes of the chassis cluster. Both devices (which are going to form a chassis cluster) must have the valid, 
identical features licenses installed on them. If both devices do not have an identical set of licenses, then 
after a failover, a particular feature (that is, a feature that is not licensed on both devices) might not work 
or the configuration might not synchronize in chassis cluster formation. Licensing is usually ordered when 
the device is purchased, and this information is bound to the chassis serial number. For example, Intrusion 
Detection and Prevention (IDP) is a licensed feature and the license for this specific feature is tied to the 
serial number of the device. 


For information about how to purchase software licenses, contact your Juniper Networks sales 
representative at https://www.juniper.net/in/en/contact-us/. 


Installing Licenses on the SRX Series Devices in a Chassis Cluster 


You can add a license key from a file or a URL, from a terminal, or from the J-Web user interface. Use the 
filename option to activate a perpetual license directly on the device. Use the url option to send a 
subscription-based license key entitlement (such as unified threat management [UTM]) to the Juniper 
Networks licensing server for authorization. If authorized, the server downloads the license to the device 
and activates it. 


Before adding new licenses, complete the following tasks: 


e Purchase the required licenses. 


e Set the chassis cluster node ID and the cluster ID. See Example: Setting the Node ID and Cluster ID for 
Security Devices in a Chassis Cluster . 


e Ensure that your SRX Series device has a connection to the Internet (if particular feature requires Internet 
or if (automatic) renewal of license through internet is to be used). For instructions on establishing basic 
connectivity, see the Getting Started Guide or Quick Start Guide for your device. 
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To install licenses on the primary node of an SRX Series device in a chassis cluster: 


1. Run the show chassis cluster status command and identify which node is primary for redundancy group 
O on your SRX Series device. 


{primary:nodeO} 

user@host> show chassis cluster status redundancy-group 0 
Cluster ups ¥ 
Node Priority Status Preempt Manual failover 
Redundancy group: 0 , Failover count: 1 


nodeO 254 primary no no 


nodel il secondary no no 


Output to this command indicates that node O is primary and node 1 is secondary. 


2. From CLI operational mode, enter one of the following CLI commands: 


e To add a license key from a file or a URL, enter the following command, specifying the filename or 
the URL where the key is located: 


user@host> request system license add filename | url 


e To add a license key from the terminal, enter the following command: 


user@host> request system license add terminal 


3. When prompted, enter the license key, separating multiple license keys with a blank line. 


If the license key you enter is invalid, an error appears in the CLI output when you press Ctrl+d to exit 
license entry mode. 


4. Verify the installed licenses. 


For more details, see Adding New Licenses (CLI Procedure). 


To install licenses on the secondary node of an SRX Series device in a chassis cluster: 
1. Initiate a failover to change node 1 (secondary node) to be the primary node: 
{primary:nodeO} 


user@host> request chassis cluster failover redundancy-group O node 1 


229 





Initiated manual failover for redundancy group 0 


NOTE: Initiating a failover to the secondary node is not required if you are installing licenses 
manually on the device. However, if you are installing the license directly from the Internet, 
you must initiate a failover. 


2. Repeat the steps described in “Step-by-Step Procedure” on page 228 to install licenses on the secondary 


node. 


3. Reboot the device for licenses to take effect. 


NOTE: You must install the updated license on both nodes of the chassis cluster before the 
existing license expires. 


NOTE: Ina chassis cluster configuration, when one device has a license installed, and the other 
device does not have the same license installed, an error message is displayed when you try to 
configure that specific feature as shown in the following example: 


[edit security utm feature-profile web-filtering type] 





"type juniper-enhanced' 
warning: requires 'wf_key_websense_ewf' license EKEKEE EEE EEE EEL EEE ECR ERE 


configuration check succeeds 


TIP: If you are not using any specific feature or license , you can delete the license from both 
devices in a chassis cluster. You need to connect to each node separately to delete the licenses. 
For details, see “Example: Deleting a License Key” on page 245. 
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Verifying Licenses on an SRX Series Device in a Chassis Cluster 


Purpose 


You can verify the licenses installed on both the devices in a chassis cluster setup by using the show system 
license installed command to view license usage. 


Action 
Licenses details on node O. 


user@host> show system license installed 


{primary:node0} 
user@host> show system license 


License usage: 


Licenses Licenses Licenses Expiry 
Feature name used installed needed 
logical-system 1 26 0 permanent 
services-offload 0 sls 0 permanent 


Licenses installed: 
License identifier: JUNOS363684 








License version: 2 

Valid for device: JN111A654AGB 

HeaeumBese 

services-offload - services offload mode 


permanent 


License identifier: JUNOS531744 








License version: 4 

Valid for device: JN111A654AGB 

II SreNe UASNS) € 

services-offload - services offload mode 


permanent 


License identifier: JUNOS558173 








License version: 4 

Valid for device: JN111A654AGB 

Healeuire's!: 

logical-system-25 —- Logical System Capacity 


permanent 


Licenses details on node 1. 


{secondary-hold:nodel} 
user@host> show system license 


License usage: 


Licenses Licenses 
Feature name used installed 
idp-sig 0 il 
logical-system il 26 
services-offload 0 1 


Licenses installed: 
License identifier: JUNOS209661 








License version: 2 

Valid for device: JN111AB4DAGB 

He cleumaesi: 

LCI SiG — IDP Signature 


permanent 


License identifier: JUNOS336648 








License version: 2 

Valid for device: JN111AB4DAGB 

Features: 

logical-system-25 -— Logical System Capacity 


permanent 


License identifier: JUNOS363685 








License version: 2 

Valid for device: JN111AB4DAGB 

ISSUE LIES} § 

services-offload - services offload mode 


permanent 


License identifier: JUNOS531745 





License version: 4 

Valid for device: JN111AB4DAGB 

IEEE UES) § 

services-offload - services offload mode 


permanent 


Meaning 


Licenses 
needed 

0 

0 

0 
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Expiry 


permanent 
permanent 


permanent 


Use the fields License version and Features to make sure that licenses installed on both the nodes are 


identical. 


Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices 


This topic provides licensing information for SRX Series devices running logical systems and tenant systems. 


Starting in Junos OS Release 18.3R1, an SRX Series device running logical systems or tenant systems 
includes three licenses by default. One license for a master logical system and the other two licenses for 
user-defined logical system or tenant system. The system does not allow you to configure additional logical 
systems or tenant systems if the number of logical systems and tenant systems exceeds the number of 
available licenses. In the earlier releases, the system allowed you to configure an additional logical system 
even if the number of logical systems exceeds the number of available licenses, but with a warning message 
of non-licensed logical-systems do not pass traffic. You can purchase licenses for additional logical systems 
and tenant systems that you intend to create. If you intend to configure an interconnect logical system or 
interconnect tenant system to use as a switch, it also requires separate licenses. 


We enforce that you do not configure more logical systems or tenant systems than the number of licenses 
you have purchased. If the number of logical systems or tenant systems that you attempt to configure 
exceeds the number of licenses that you have purchased, then the system displays an error message similar 
to the following: 


user@host> commit 


error: 2 more multitenancy license(s) are needed! 





error: configuration check-out failed 


You can use the show system license status all-logical-systems-tenants or show system license usage 
commands to view the active logical systems and tenant systems on the device. 


user@host> show system license status all-logical-systems-tenants 





logical system nam license status 








root-logical-system nabled 
ESYS2 enabled 
LSYSO enabled 
IBS NES ILI enabled 
ILyS Nets) AlZz enabled 
ESYsS23 emalolkec! 
A SNGSiL emails 
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LS S2 enabled 
TSMSs enabled 





user@host> show system license usage 








Licenses Licenses Licenses Expiry 
Feature name used installed needed 
logical-system 9 ia 0 AQILS=O5=1'3} 


WOSeOOs0O Csr 


When you use SRX Series devices running logical systems or tenant systems ina chassis cluster, you must 
purchase and install the same number of licenses for each node in the chassis cluster. Logical systems or 
tenant systems licenses pertain to a single chassis, or node, within a chassis cluster and not to the cluster 


collectively. 


SEE ALSO 


Understanding Logical Systems for SRX Series Services Gateways 


Understanding Tenant Systems 


Understanding UTM Licensing 


The majority of UTM features function as a subscription service requiring a license. You can redeem this 
license once you have purchased your subscription license SKUs. You redeem your license by entering 
your authorization code and chassis serial number into the Customer Service license portal interface. Once 
your entitlement is generated, you can use the CLI from your device to send a license update request to 
the license portal. The license portal then sends your subscription license directly to the device. 


NOTE: The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, 
SRX Series, EX Series, NFX, vBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, 
JSA, SBR Carrier, Screen OS and so on) access the License Management System (LMS). 


NOTE: UTM requires 1 GB of memory. 


Table 110: UTM Feature Subscription Service License Requirements 


UTM Feature 


Antispam 


Antivirus: sophos 


Content Filtering 


Web Filtering: integrated 


Web Filtering: redirect 


Web Filtering: local 


Web Filtering: enhanced 


NOTE: License enforcement is supported on all SRX Series devices. Licensed features including 
anti-virus or Enhanced Web Filtering will not function until a license has been installed. The 
license must be installed after installing or upgrading to a new Junos OS Release version. 
Unlicensed features such as UTM blocklists and allowlists will continue to function without a 


license. 


Updating UTM Licenses (CLI Procedure) 


To apply the UTM subscription license to SRX Series devices, use the following CLI command: 


user@host> request system license update 


After you install the license for SRX300, SRX320, SRX340, SRX345, SRX550M, and SRX1400 devices, 
reboot the device. The device reserves additional memory for UTM features and hence decreases the 


session capacity. 


For SRX3400, SRX3600, SRX4600, SRX5600 and SRX5800 devices, use the following command to manually 
reallocate the memory for UTM features: 


user@host>set security forwarding-process application-services enable-utm-memory 


Requires License 


Reboot the device for the configuration to take effect. 
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NOTE: SRX1500, SRX4100 and SRX4200 devices have enough memory for UTM. These devices 
do not require any command for memory allocation. 


SEE ALSO 
Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices 
Installing the IPS License (CLI) 


You can either download an IPS license from the license server, or manually install IPS if you received a 
license from Juniper Networks. 


Access the SRX Series device console through the serial cable plugged into the console port on the device 
or by using a terminal session such as SSH. 


To apply your IPS subscription license to the device, use the following CLI command: 


user@host> request system license update 


If you received a license for manual installation, perform the following tasks: 


1. Access the SRX Series Services Gateway console either by plugging the serial cable into the console 
port on the device or by using a terminal session such as SSH. 


2. Check for an IPS license (required for all IPS updates): 


user@host> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
logical-system 0 0 0 permanent 


3. If there are no licenses installed, obtain the chassis serial number by using the following CLI command: 


user@host> show chassis hardware 
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4. Aserial number is needed to generate the IPS license. You can add a license key from a file or URL or 


from the terminal. 


e From a file or URL: 

user@host> request system license add <file name> 
e From the terminal: 

user@host> request system license add terminal 


5. When prompted, enter the license key, separating multiple license keys with a blank line. If the license 
key you enter is invalid, an error is generated when you press Ctrl-D to exit license entry mode. 


6. Verify the system license by entering the show system license command. 


user@host> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
idp-sig 4 il 0 permanent 


Licenses installed: 
License identifier: JUNOS208639 








License version: 2 

Valid for device: AA4508AD0005 

Hoaleuise st: 

idp-sig - IDP Signature 

date-based, 2009-0406 08:00:00 GMT-8 —- 2010-04-06 08:00:00 GMT-8 


SEE ALSO 


Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices 


Installing and Verifying Licenses for an Application Signature Package 


The Junos OS application signature package update is a separately licensed subscription service. You must 
install the application signature package update license key on your device to download and install the 


signature database updates provided by Juniper Networks. If your license key expires, you can continue 
to use the locally stored application signature package content. 


Licensing is usually ordered when the device is purchased, and this information is bound to the chassis 
serial number. These instructions assume that you already have the license. If you did not order the license 
during the purchase of the device, contact your account team or Juniper customer care for assistance. For 
more information, refer to the Knowledge Base article KB9731 at 
https://kb.juniper.net/InfoCenter/index?page=home. 


Starting from Junos OS 15.1X49-D30 and Junos OS Release 17.3R1, on SRX1500 devices, AppSecure is 
part of Junos Software Enhanced (JSE) software license package. There is no separate license key for 
AppSecure is available. You must use JSE software license on your device to download and install the 
ApplID signature database updates, or to use other AppSecure features such as AppFW, AppQoS, and 
AppTrack. 


Starting from Junos OS 15.1X49-D30 and Junos OS Release 17.3R1, on SRX300, SRX320, SRX340, and 
SRX345 devices, AppSecure is part of Junos Software Enhanced (JSE) software license package. There is 
no separate license key for AppSecure is available. You must use JSE software license on your device to 
download and install the AppID signature database updates, or to use other AppSecure features such as 
AppFW, AppQoS, and AppTrack. 


Starting from 15.1X49-D65 and Junos OS Release 17.3R1, on SRX4100, and SRX4200 devices, AppSecure 
is part of Junos Software Enhanced (JSE) license package. There is no separate license key for AppSecure 
is available. You must use JSE software license on your device to download and install the AppID signature 
database updates, or to use other AppSecure features such as AppFW, AppQoS, and AppTrack. 


Starting from Junos OS Release 17.4R1, for SRX4600, application signatures are included by default. 


Junos Software Base (JSB) package does not include application signatures. Please refer to the product 
Data Sheets at SRX Series Services Gateways for details, or contact your Juniper Account Team or Juniper 
Partner. 


You can install the license on the SRX Series device using either the automatic method or manual method 
as follows: 


e Install your license automatically on the device. 


To install or update your license automatically, your device must be connected to the Internet . 


user@host> request system license update 


Trying to update license keys from https://ael.juniper.net, use 'show system 


license' to check status. 


e Install the licenses manually on the device. 


237 


238 


user@host> request system license add terminal 


[Type “D at a new line to end input, 


enter blank line between each license key] 


Paste the license key and press Enter to continue. 
e Verify the license is installed on your device. 


Use the show system license command command to view license usage, as shown in the following 
example: 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 


logical-system 4 iL 3 permanent 


License identifier: JUNOSXXXXXX 





License version: 2 
Valid for device: AA4XXXxX005 
PSCC UICSS 8 
appid-sig - APPID Signature 
date-based, 2014-02-17 08:00:00 GMI-8 —- 2015-02-11 08:00:00 GMT-8 


The output sample is truncated to display only license usage details. 


SEE ALSO 


| Adding New Licenses (CLI Procedure) | 64 


| Managing Junos OS Licenses 


IN THIS SECTION 


@ Displaying License Keys in J-Web | 239 


@ Downloading License Keys | 239 


Generating a License Key | 239 
Saving License Keys | 240 
Updating License Keys (CLI) | 240 


Example: Adding a New License Key | 242 


Example: Deleting a License Key | 245 


Displaying License Keys in J-Web 


To display license keys installed on the device: 
1. In the J-Web interface, under Administration>License Management>Installed Licenses, click Add to 


add a new license key. 


2. Under Installed Licenses, click Display Keys to display all the license keys installed on the device. 


A screen displaying the license keys in text format appears. Multiple licenses are separated by a blank 
line. 


Downloading License Keys 


To download license keys installed on the device: 


1. Inthe J-Web interface, under Administration>License Management> Installed Licenses, click Download 
Keys to download all the license keys installed on the device to a single file. 


2. Select Save it to disk and specify the file to which the license keys are to be written. 


Generating a License Key 


To generate a license key: 
1. Gather the authorization code that you received when you purchased your license as well as your 


device serial number. 


2. Go to the Juniper Networks licensing page at: 


https://www.juniper.net/Icrs/generateLicense.do 
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3. Enter the device serial number and authorization code in the webpage and click Generate. Depending 
on the type of license you purchased, you will receive one of the following responses: 


e License key—If you purchased a perpetual license, you will receive a license key from the licensing 
management system. You can enter this key directly into the system to activate the feature on your 
device. 


e License key entitlement—If you purchased a subscription-based license, you will receive a license 
key entitlement from the licensing management system. You can use this entitlement to validate 
your license on the Juniper Networks licensing server and download the feature license from the 
server to your device. 


Saving License Keys 


To save license keys installed on the device: 


1. From operational mode, save the installed license keys to a file or URL. 


user@host>request system license save filename | url 


For example, the following command saves the installed license keys to a file named license.config: 


request system license save ftp://user@host/license.conf 


SEE ALSO 


Junos OS Feature License Keys | 57 


Updating License Keys (CLI) 


Use this task to update a subscription license or a trial license. You can do immediate update from command 
mode or set up automatic updates using the CLI. 


You can set up a proxy server to allow indirect access to the license portal. To set up a proxy server for 
license updates, see Example: Configuring a Proxy Server for License Updates. 


The products supported by the Juniper Agile Licensing (JAL) portal includes: QFX series, SRX Series, EX 
Series, NFX, vBNG, vMX, vSRX, and ACX. For other Juniper products (SPACE, JSA, SBR Carrier, Screen 
OS and so on) access the License Management System (LMS). 
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To do immediate update of a license key from command mode: 


1. 


From operational mode, do one of the following tasks: 


e Update the license keys immediately from the license portal. You can only use this command to 
update subscription-based licenses (such as UTM). 


user@host> request system license update 


The request system license update command always uses the default license portal. 


e Update the trial license keys immediately from the license portal. 


user@host>request system license update trial 


To enable automatic license updates from the CLI: 


1. 


Contact your account team or Juniper Networks Customer Care to extend the validity period of existing 
license keys and obtain the URL for a valid update server. 


. Once you have successfully extended your license key and received the update server URL, configure 


the auto-update parameter: 


user@host> set system license autoupdate url https://ae1.juniper.net/ 


. (Optional) Configure renew options. The following sample allows the device to contact the license 


server 30 days before the current license expires and sends an automatic update request every 6 hours. 


user@host> set system license renew before-expiration 30 
user@host> set system license renew interval 6 


SEE ALSO 


Understanding Chassis Cluster Licensing Requirements | 226 


Understanding Licenses for Logical Systems and Tenant Systems on SRX Series Devices | 232 


Example: Adding a New License Key 


IN THIS SECTION 


Requirements | 242 
Overview | 242 
Configuration | 242 


Verification | 244 


This example shows how to add a new license key. 


Requirements 

Before you begin, confirm that your Junos OS feature requires you to purchase, install, and manage a 
separate software license. 

Overview 


You can add a license key from a file or URL, from a terminal, or from the J-Web user interface. Use the 

filename option to activate a perpetual license directly on the device. (Most feature licenses are perpetual.) 
Use the url to send a subscription-based license key entitlement (such as UTM) to the Juniper Networks 
licensing server for authorization. If authorized, the server downloads the license to the device and activates 
it. 


In this example, the file name is bgp-reflection. 


Configuration 


CLI Quick Configuration 


To quickly configure this section of the example, copy the following commands, paste them into a text 
file, remove any line breaks, change any details necessary to match your network configuration, copy and 
paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration 
mode. 


From operational mode, you can add a license key in either way: 


e From a file or URL: 


user@hostname> request system license add bgp-reflection 


e From the terminal: 


user@hostname> request system license add terminal 
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GUI Step-by-Step Procedure 


To add a new license key: 


1. Inthe J-Web user interface, under Administration>License Management> Installed Licenses, click Add 
to add a new license key. 


2. Do one of the following, using a blank line to separate multiple license keys: 


e In the License File URL box, type the full URL to the destination file containing the license key to be 
added. 


e In the License Key Text box, paste the license key text, in plain-text format, for the license to be 
added. 


3. Click OK to add the license key. 


If you added the SRX100 Memory Upgrade license, the device reboots immediately and comes back 
up as a high-memory device. 


4. Click OK to check your configuration and save it as a candidate configuration. 


5. If you are done configuring the device, click Commit Options>Commit. 


Step-by-Step Procedure 
To add a new license key: 


1. From operational mode, add a license key in either way: 


e From a file or URL: 


user@host> request system license add bgp-reflection 


e From the terminal: 


user@host>request system license add terminal 


2. When prompted, enter the license key, separating multiple license keys with a blank line. If the license 
key you enter is invalid, an error is generated when you press Ctrl-D to exit license entry mode. 


If you added the SRX100 Memory Upgrade license, the device reboots immediately and comes back 
up as a high-memory device. 


Results 

From operational mode, confirm your configuration by entering the show system license command. If the 
output does not display the intended configuration, repeat the configuration instructions in this example 
to correct it. 
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user@hostname> show system license 


License usage: 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
bgp-reflection 0 i O permanent 


Licenses installed: 
License identifier: GO300000xxxx 








License version: 2 

Valid for device: JN001875AB 

He cieuisesi: 

bgp-reflection — Border Gateway Protocol route reflection 


permanent 


License identifier: GO300000xxxx 





License version: 2 


Valid for device: JN001875AB 


If you are done configuring the device, enter commit from configuration mode. 


Verification 


Confirm that the configuration is working properly. 


Verifying Installed Licenses 


Purpose 


Verify that the expected licenses have been installed and are active on the device. 


Action 


From operational mode, enter the show system license command. 


The output shows a list of the licenses used and a list of the licenses installed on the device and when they 
expire. 


Verifying License Usage 


Purpose 


Verify that the licenses fully cover the feature configuration on the device. 


Action 


From operational mode, enter the show system license usage command. 


user@hostname> show system license usage 





Licenses Licenses Licenses Expiry 
Feature name used installed needed 
bgp-reflection dl il 0 permanent 


The output shows a list of the licenses installed on the device and how they are used. 


Verifying Installed License Keys 


Purpose 
Verify that the license keys were installed on the device. 


Action 
From operational mode, enter the show system license keys command. 


user@hostname> show system license keys 


XXXXXXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 
XXXKXXX KXXXKKX XKMXKKK XKKXKK MXKXKRKX KRKXKKK 
RRRKKX KXKRKX XRKXKXKKK KRKKKRX XMKKXM XRMKKX 


XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX XXXXXX 


The output shows a list of the license keys installed on the device. Verify that each expected license key 


is present. 


Example: Deleting a License Key 


IN THIS SECTION 


Requirements | 246 
Overview | 246 
Configuration | 246 


Verification | 247 
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This example shows how to delete a license key. 


Requirements 


Before you delete a license key, confirm that it is no longer needed. 


Overview 


You can delete a license key from the CLI or J-Web user interface. In this example, the license ID is 
GO300000xxxx. 


Configuration 


CLI Quick Configuration 


To quickly configure this section of the example, copy the following commands, paste them into a text 
file, remove any line breaks, change any details necessary to match your network configuration, copy and 
paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration 
mode. 


user@host> request system license delete GO300000xxxx 


GUI Step-by-Step Procedure 


To delete a license key: 


1. In the J-Web user interface, under Administration>License Management>Installed Licenses. 


2. Select the check box of the license or licenses you want to delete. 


3. Click Delete. 


If you deleted the SRX100 Memory Upgrade license, the device reboots immediately and comes back 
up as alow-memory device. 


4. Click OK to check your configuration and save it as a candidate configuration. 


5. If you are done configuring the device, click Commit Options>Commit. 


Step-by-Step Procedure 


To delete a license key: 


1. From operational mode, for each license, enter the following command and specify the license ID. You 
can delete only one license at a time. 


user@host> request system license delete GO300000xxxx 
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If you deleted the SRX100 Memory Upgrade license, the device reboots immediately and comes back 
up as alow-memory device. 


Results 

From configuration mode, confirm your deletion by entering the show system license command. The 
license key you deleted will be removed. If the output does not display the intended configuration, repeat 
the configuration instructions in this example to correct it. 


If you are done configuring the device, enter commit from configuration mode. 


Verification 


IN THIS SECTION 


@ Verifying Installed Licenses | 247 


Confirm that the configuration is working properly. 


Verifying Installed Licenses 


Purpose 


Verify that the expected licenses have been removed from the device. 


Action 


From operational mode, enter the show system license command. 


Licenses for vSRX 


IN THIS SECTION 


vSRX Feature Licenses Overview | 248 
Managing Licenses for vSRX | 256 
vSRX License Model Numbers | 264 


vSRX License Model Numbers for Contrail, KVM, Microsoft Hyper-V, and VMware | 266 


vSRX Feature Licenses Overview 
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Some Junos OS software features require a license to activate the feature. 


To enable a licensed feature, you need to purchase, install, manage, and verify a license key that corresponds 
to each licensed feature. To conform to software feature licensing requirements, you must purchase one 
license per feature per instance. The presence of the appropriate software unlocking key on your virtual 
instance allows you to configure and use the licensed feature. 


If applicable for your vSRX deployment, vSRX pay-as-you-go images do not require any separate licenses. 


vSRX License Procurement and Renewal 


Licenses are usually ordered when the software application is purchased, and this information is bound to 
a customer ID. If you did not order the licenses when you purchased your software application, contact 
your account team or Juniper Networks Customer Care for assistance. 


Licenses can be procured from the Juniper Networks License Management System (LMS). 


For license renewal, use the show system license command to find the Juniper vSRX software serial number 
that you use to renew a license. 


vsrx> show system license 


License usage: 





Licenses Licenses Licenses Expiry 


Feature name used installed needed 
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Virtual Appliance il il 0 58 days 


Licenses installed: 
License identifier: E420588955 











License version: 4 
Software Serial Number: 20150625 
Customer ID: vSRX-JuniperEval 


Features: 





Virtual Appliance - Virtual Appliance 


count-down, Original validity: 60 days 


License identifier: JUNOS657051 








License version: 4 

Software Serial Number: 9XXXXAXXXXXXX9 
Customer ID: MyCompany 

INQSUE WIE SS) § 

Virtual Appliance - Virtual Appliance 


permanent 


Do not use the show chassis hardware command to get the serial number on vSRX, because that command 
is only appropriate for the physical SRX Series devices. Also, the license for advanced security features 
available on the physical SRX Series devices cannot be used with vSRX deployments. 


If you are performing a software downgrade with licenses installed, you will see an error message in the 
CLI when you try to configure the licensed features or run the show system license status command. 


We recommend deleting existing licenses before performing a software downgrade. 


vSRX Evaluation License 


To speed deployment of licensed features, the vSRX software image provides you with a 60-day product 
evaluation license and a 30-day advanced security features license, both of which allow you to use vSRX 
and licensed features for a specified period without having to install a license key. 


Table 111 on page 249 lists vSRX evaluation license types. 


Table 111: vSRX Evaluation License Type 


License Model 
License Package Type Period Number 


Trial license (temporary for | Product evaluation-Basic 60 days - 
evaluation only) 
Product evaluation-Advanced 30 days - 
features 
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Product Evaluation License 


The vSRX software image includes a 60-day trial license. When you download and install the vSRX image, 
you are entitled to use this trial license for 60 days. It is intended as an evaluation license for using vSRX. 
This product-unlocking license is required to use the basic functions of the vSRX, such as networking, 
routing, and basic security features (such as stateful firewall). 


The use of the 60-day trial license does not include vSRX support unless you already have a pre-existing 
vSRX support contract. If you require support during this 60-day evaluation period, please work with your 
Juniper Account team or go to the J-Net Community forum (https://forums.juniper.net/) and view the 
Support topics under the vSRX category. 


Within 30 days of the license expiration date, a license expiration warning appears each time you log in 

to the vSRX instance. After the product evaluation license expires, you will not be able to use the vSRX; 
it will be disabled and flow configuration options will not work (the vSRX will stop forwarding traffic). At 
this point, only management interfaces and CLI configurations are preserved. 


Advanced Security Features Evaluation License 


The advanced security features license is a 30-day trial license for vSRX that is required for advanced 
security features such as UTM, IDP, and AppSecure. You can download the trial license for advanced 
security features from the vSRX Free Trial License Page. 


The 30-day trial license period begins on the day you enable the enhanced security features after you 
install the 60-day product evaluation license for vVSRX. To continue using vSRX features after the 30-day 
license period expires, you must purchase and install the license; otherwise, the features are disabled. If 
the license for advanced security features expires while the evaluation license (product unlocking license) 
is still valid, only the advanced security features that require a license are disabled. 


The UTM advanced features have a slightly different trial license strategy. UTM does not requires 30-day 
trial license but only a 30-day grace period. Once the 30-day advanced security features trial license 
expires, Juniper Networks supports a 30-day grace period for you to continue using UTM features. The 
30-day grace period goes into effect after the 30-trial license expires. 


There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention (ATP). This is a 
second license that you can apply for a 30-day period in addition to the advanced security features license 
for vSRX to enable the Juniper Sky ATP features. You can download the Juniper Sky ATP trial license from 
the vSRX Free Trial License Page. 


License Types 


Juniper Networks provides a variety of licenses for both basic firewall features and advanced security 
features for different throughputs and durations. 


If you want to use vSRX to provide basic firewall features, you can use standard (basic) licenses. However, 
to use some of the more advanced security features, such as AppSecure, IDP, and UTM, you might need 
to purchase advanced features licenses. 


250 


251 


The high-level categories for licenses are: 


e Throughput—All licenses have an associated throughput. Throughput rates include 1 Gbps, 2 Gbps, and 
4 Gbps on most platforms. 


Features—Licenses are available for different combinations of feature sets, from standard (STD) through 
Content Security Bundled (CSB). 


Individual or bundled—Licenses can be individual (a la carte) licenses for a set of features, or can be 
bundled together to provide a broad range of features in one easy license to maintain. 


Individual licenses are not supported. 


Duration—All licenses have an associated time duration. You can purchase basic licenses as perpetual 
(never expire) or subscription based (1-year or 3-year duration). All vSRX licenses are subscription based. 


e New or renewal—All subscription licenses are either new (first-time purchase) or renewals (extending 
the license duration when the initial new subscription license is about to expire). 


Figure 16 on page 251 shows a sample license SKU and identifies how each field maps to these categories. 


Figure 16: Sample vSRX License SKU 


Bundled or New or 
Throughput individual renewal 
3 
Product Feature set Duration $ 


These categories of licenses can also be combined, or stacked, to provide more flexibility for your vSRX 
use cases. 


Throughput 


Bandwidth or throughput license types allow you to use a single instance of the software for up to the 
maximum throughput specified in the license entitlement. Throughput can be combined on a single instance 
of the software so that the maximum throughput for that instance is the aggregate of all the throughput 
licenses assigned to that instance. A throughput license cannot be split across multiple instances. Throughput 
is identified in the license entitlement in megabits per second (Mbps), or gigabits per second (Gbps). 


For example, if you want 3 Gbps of throughput for a vSRX instance using the STD features, you would 
purchase a 1G STD license and a 2G STD license and install both on the vSRX. If you wanted 2 Gbps of 
throughput on two vSRX instances acting as a chassis cluster, you could not use the same 2 Gbps license 
on both vSRX instances. You would need to purchase one set of licenses for each vSRX instance in the 
cluster. 
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License Duration 


All licenses can be perpetual or subscription based. 


Perpetual license-A perpetual license allows you to use the licensed software indefinitely. Perpetual 


licenses do not require renewals. Perpetual licenses do not include maintenance and upgrade support. 
You must purchase that separately, vSRX software releases such as vSRX for Nutanix do not support 
perpetual licenses. 


Subscription license-A subscription license is an annual license that allows you to use the licensed 


software feature for the matching duration. Subscriptions might involve periodic downloads of content 
(such as for IDP threat signature files). Subscription licenses start when you retrieve the license key or 
30 days after purchase if you have not retrieved the license key. At the end of the license period, you 
need to renew the license to continue using it. 


All subscription licenses are renewable. To renew a subscription license, purchase a new subscription 
of the same license. For more information, see Subscription - Register and Install. 


Individual (4 la carte) Feature Licenses 


Every vSRX instance requires at least one standard license to support the desired throughput rate. Beyond 
that, you can select from a range of individual feature licenses that provide additional security feature sets. 
The feature license must match the standard license rate. 


Individual licenses are not supported. 


For example, if you need AppSecure and Sophos antivirus features at 1 Gbps of throughput for a year, 
you could purchase the following individual licenses: 


e VSRX-STD-1G-1—Provides the standard feature set and 1 Gbps of throughput. 
e VSRX-CS-1G-1—Provides the advanced features. 


Bundled Licenses 

Bundled licenses simplify the license management by combining one or more individual licenses into a 
single bundled license. Instead of installing and managing a standard throughput license and one or more 
individual advanced feature licenses, you can purchase one of the bundle license options and manage one 
license instead. 


For example, if you need AppSecure and Sophos antivirus features at 1 Gbps of throughput for a year, 
you could purchase the single bundled VSRX-CS-B-1G-1 license, which includes the STD throughput 
license. This means you only need to manage one license instead of two individual licenses. 


Stacking Licenses 


You can combine individual or bundled licenses to combine features or build up the overall supplied 
throughput for the vSRX instance. 
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For example, you can combine a 1-Gbps license and a 2-Gbps license to have 3 Gbps of throughput for 
the vSRX instance. You can also combine individual licenses, such as Sophos antivirus (SAV) and Websense 
Enhanced Web Filtering (EWF) to get both sets of security features. 


Individual licenses require an STD license with the same throughput rate. 


vSRX License Keys Components 

A license key consists of two parts: 

e License |ID—Alphanumeric string that uniquely identifies the license key. When a license is generated, 
it is given a license ID. 

e License data—Block of binary data that defines and stores all license key objects. 


For example, in the following typical license key, the string E413XXXX57 is the license ID, and the trailing 
block of data is the license data: 


E413XXXX57 aaaaaa bbbbbb cccccc dddddd eeeeee ffFELL 
cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa 
dddadambbbbobbeecececddddddMesce Sewn imi tee 
cccccc bbbbbb dddddd aaaaaa ffffff 





The license data conveys the customer ID and the software serial number (Juniper Networks support 
reference number) to the vSRX instance. 
License Management Fields Summary 


The Licenses window displays a summary of licensed features that are configured on the vSRX instance 
and a list of licenses that are installed on the vSRX instance. 


To view the license details, select Maintain>Licenses in the J-Web user interface. The Licenses window 
appears as shown in Figure 17 on page 254, 
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Figure 17: J-Web Licenses Window Showing Installed Licenses 


_ vsrx2-ide-pv11 / VSRX 


Dashboard Configure Monitor Maintain Troubleshoot Commit - 
> Config Management 
Licenses 
> Software 
Feature Summary 
Licenses Feature Licenses Used Licenses Installed LicensesNeeded License Expires on 
Anti Virus with Sophos Engine 0 1 0 2016-07-29 
Reboot Virtual Appliance 1 1 0 2016-04-25 
Snapshot Installed Licenses 
Files Add... Delete © Update = Update Trial Display Keys... Download Keys 
ID State Version Group Enabled Features Expiration 
C)  §420588955 valid 4 No group information —_Vietual Appliance - Virtual Applance count-down 
C) 3uwos606279 valid No group information av_key_sophos_engine - Anti Vieus with Sophos Engine datte-based, 2015-02-27 - 2016-02-28 
av_key_sophos_engine - Anti Virus with Sophos Engine  date-based, 2015-04-15 - 2016-04-15 
wf_key_websense_ewf - Web Filtering EWF date-based, 2015-04-15 - 2016-04-15 
C] 3uNo0s623127  vald ‘No group information —_appid-sig - APPID Signature date-based, 2015-04-15 - 2016-04-15 
idp-sig - IDP Signature date-based, 2015-04-15 - 2016-04-15 
anti_spam_key_sbl - Anti-Spam date-based, 2015-04-15 - 2016-04-15 
JUNOS656626 = vald No group information —_av_key_sophos_engine - Anti Virus with Sophos Engine date-based, 2015-07-29 - 2016-07-29 

















No group information 


Add... Delete © Update —_ Update Trial 


Virtual Appliance - Virtual Appliance date-based, 2015-07-29 - 2016-04-25 


Display Keys... Download Keys 





You can also view the details of a license in the CLI using the show system license command. The following 
sample shows details of an evaluation license in the CLI: 


License usage: 














Licenses Licenses Licenses Expiry 

Feature name used installed needed 

anti_spam_key_sbl 0 dl 0 AILS O44 — i 5) 
O8 300200 CST 

idp-sig 0 1 0 ZVLG=O4—i5) 
OS 300200 CST 

appid-sig 0 1 0 2016-04-15 
08:00:00 CST 

av_key_sophos_engine 0 3 0 DOINGS =) J = 28) 
08300200 CST 

wf_key_websense_ewf 0 i 0 ZOUSG OARS 
08300200 €St 

Virtual Appliance al il 0 2016-04-25 
08:00:00 CST 
Licenses installed: 

License identifier: E420588955 

License version: 4 

Software Serial Number: 20150625 





Customer ID: vSRX-JuniperEval 


Features: 
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Virtual Appliance - Virtual Appliance 


count-—down, 


Original validity: 60 days 


The information on the license management page is summarized in Table 34 on page 58. 


Table 112: Summary of License Management Fields 


Field Name 


Feature Summary 


Feature 


Licenses Used 


Licenses Installed 


Licenses Needed 


Licenses expires on 


Installed Licenses 


ID 


State 


Version 


Group 


Enabled Features 


Expiration 


Definition 


Name of the licensed feature: 


e Features—Software feature licenses. 


e All features—All-inclusive licenses. 


Number of licenses currently being used on the vSRX instance. Usage is determined 
by the configuration. If a feature license exists and that feature is configured, the 
license is considered used. 

Number of licenses installed on the vSRX instance for the particular feature. 
Number of licenses required for legal use of the feature. Usage is determined by 
the configuration on the vSRX instance: If a feature is configured and the license 


for that feature is not installed, a license is needed. 


Date the license expires. 


Unique alphanumeric ID of the license. 


Valid—The installed license key is valid. 


Invalid—The installed license key is not valid. 


Numeric version number of the license key. 


If the license defines a group license, this field displays the group definition. 


Because group licenses are currently unsupported, this field is always blank. 


Name of the feature that is enabled with the particular license. 


Date the license expires. 
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Table 112: Summary of License Management Fields (continued) 


Field Name Definition 


Software serial number The serial number is a unique 14-digit number that Juniper Networks uses to 
identify your particular software installation. You can find the software serial 
number in the Software Serial Number Certificate attached to the e-mail that was 
sent when you ordered your Juniper Networks software or license. You can also 
use the show system license command to find the software serial number. 


Customer ID ID that identifies the registered user. 


Managing Licenses for vSRX 


IN THIS SECTION 


vSRX Evaluation License Installation Process | 256 
Adding a New License Key with J-Web | 258 
Adding a New License Key from the CLI | 259 
View vSRX License Information | 260 

Updating vSRX Licenses | 260 

Deleting a License with J-Web | 261 

Deleting a License with the CLI | 262 


License Warning Messages | 263 


Before you begin, ensure that you have retrieved the license key from the Juniper Agile Licensing (JAL) 
Portal. 


For more information on Juniper Agile Licensing (JAL) Portal, see Juniper Agile Licensing (JAL) Portal - 
Frequently Asked Questions 


This section includes the following topics: 


vSRX Evaluation License Installation Process 


Juniper Networks provides a 60-day evaluation license for vSRX standard features. When you download 
and install the vSRX image, you are entitled to use this evaluation license for 60 days as a trial. In addition 
to the 60-day vSRX evaluation license, there is a 30-day advanced security features trial license for vSRX 
that is required for advanced security features such as UTM, IDP, and AppSecure. 


You can download the 30-day advanced security feature trial license from the vSRX Free Trial License 
Page. 


There is also a 30-day trial license available for Juniper Sky Advanced Threat Prevention (ATP). This is a 
second license that you can apply for a 30-day period in addition to the advanced security features license 
for vSRX to enable the Sky ATP features. You can download the Sky ATP trial license from the vSRX Free 
Trial License Page 


Installation of the advanced security feature trial license is similar to the regular license installation performed 
from the CLI (see “Adding a New License Key from the CLI” on page 259). 


Within 30 days of the license expiration date, a license expiration warning appears each time you log in 

to the vSRX instance. After the product evaluation license expires, you will not be able to use the vSRX; 
it will be disabled and flow configuration options will not work (the vSRX will stop forwarding traffic). At 
this point, only management interfaces and CLI configurations are preserved. 


The 30-day evaluation license period begins on the day you enable enhanced security features after 
installing evaluation licenses. 


To continue using vSRX features after an optional 30-day evaluation period, you must purchase and install 
the license. Otherwise, the features are disabled. 


For details about the 60- and 30-day license evaluation periods for the vSRX see “vSRX Feature Licenses 
Overview” on page 248 . 
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Adding a New License Key with J-Web 


To install a license using the J-Web interface: 


1. Select Maintain>Licenses on the J-Web user interface. The Licenses window is displayed as shown in 
Figure 18 on page 258. 


Figure 18: J-Web Licenses Window 





Dashboard Configure Monitor Maintain Troubleshoot Commit - 





> Config Management 








Licenses 
) Software pa 
Licenses No licenses are installed. 
Installed Licenses 
Reboot 
No licenses are installed. 
Snapshot [ Add... || Update || Update Trial | 





2. Under Installed Licenses, click Add. The Add License window is displayed as shown in 
Figure 19 on page 258. 


Figure 19: Add License Window 
































Dashboard Configure Monitor Maintain Troubleshoot Commit - 
> Config Management = 
Licenses 
> Software add Vicenae 
Licenses Enter a valid URL to the license file to add, or paste the text of the license file below. (Multiple keys separated by a blank line) 
Reboot License File URL 
E41301 a1234 b1i234 c25633 d6é5438 
Snapshot 
a1234 b1234 c25633 d6é5438 
os Fee al234 b1234 c25633 d65438 
al234 b1234 c25633 d65438 
OK || Cancel 














3. Do one of the following, using a blank line to separate multiple license keys: 


e Enter the full URL to the destination file containing the license key in the License File URL box. 
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e Paste the license key text, in plaintext format, in the License Key Text box. 


4. Click OK to add the license key. The License Details window is displayed as shown in 
Figure 20 on page 259. 


Figure 20: License Details Window 











Dashboard Configure Monitor Maintain Troubleshoot Commit ~ 


) Config Management 





Licenses 
) Software 
Feature Summary 
Licenses Feature Licenses Used Licenses Installed LicensesNeeded License Expires on 
Anti-Spam it) 2 0 2016-04-15 
Reboot IDP Signature 0 1 0 2016-04-15 
APPID Signature 0 x 0 2016-04-15 
Snapshot 
Anti Virus with Sophos Engine 0 4 0 2016-07-29 
Files Web Filtering EWF 0 1 0 2016-04-15 
Virtual Appliance 1 Zz 0 2016-04-25 


The license key is installed and activated on the vSRX instance. 
Adding a New License Key from the CLI 
You can add a license key from a local file, from a remote URL, or from the terminal. 


To install a license from the CLI: 


1. Use the request system license add operational mode command to either add the license from a local 
file or remote URL that contains the license key, or to manually paste the license key in the terminal. 


user@vsrx> request system license add terminal 


[Type *D at a new line to end input, 


enter blank line between each license key] 


E413XXXX57 aaaaaa bbbbbb cccccc dddddd eeeeee ffffff 
cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa 
ddaiddcmobbbobmecceccmedddddmeceec mers teeters 
cccccc bbbbbb dddddd aaaaaa fffffFf 





E413XXXX57: successfully added 





add license complet (no errors) 





You can save the license key to a file and upload the file to the vSRX file system through FTP or Secure 
Copy (SCP), and then use the request system license add file-name command to install the license. 
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2. Optionally, use the show system license command to view details of the licenses. 


root@host> show system license 





License usage: Licenses Licenses Licenses Expiry 
Feature name used installed needed 
wf key websense ewf il 0 il invalid 


Licenses installed: none 


The license key is installed and activated on the vSRX instance. 


View vSRX License Information 


You can view the vSRX license information using either of the following two methods: 


e Serial Number Entitlement 


e Juniper Agile Licensing Portal 
To view the vSRX licenses information using Serial Number Entitlement: 


1. Navigate to the Serial Number Entitlement. 


2. Enter the Serial Number or Software Support Reference Number or Contract ID in the data input field. 


3. Click View Entitlement Information to see the vSRX license information for the given Serial Number or 
Software Support Reference Number or Contract ID. 
To view the vSRX licenses information using Juniper Agile Licensing Portal 


1. Log in to the Juniper Agile Licensing Portal. 


2. Navigate to My Entitlements section to see the vSRX license information. 


Updating vSRX Licenses 
You can update the vSRX licenses using either of the following two methods: 
e Automatic license update using the CLI 


e Manual license update using the CLI 


As a prerequisite, you must install at least one valid license key on your vSRX instance for required features. 
Automatic license updates as well as manual license updates are performed based on a valid software 
serial number and customer ID embedded in the license key. 
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To enable automatic license updates from the CLI: 


1. Contact your account team or Juniper Networks Customer Care to extend the validity period of existing 
license keys and obtain the URL for a valid update server. 


2. Once you have successfully extended your license key and received the update server URL, configure 
the auto-update parameter: 


user@host# set system license autoupdate url https://ae1.juniper.net/ 


3. Configure renew options (if required). The following sample allows vSRX to contact the license server 
30 days before the current license expires and sends an automatic update request every 6 hours. 


user@host> set system license renew before-expiration 30 
user@host> set system license renew interval 6 


To manually update the licenses from the CLI: 


1. Use the following command to update the license keys manually: 


user@host> request system license update <url.of.license.server> 


This command sends a license update request to the license server immediately. 


The request system license update command will always use the default Juniper license server: 
https://ae1.juniper.net 


2. Check the status of the license by entering the show system license command. 


Deleting a License with J-Web 


To delete a license using the J-Web interface: 


1. Select Maintain>Licenses. 


2. Select the check box of the license or licenses you want to delete as shown in Figure 21 on page 262. 
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Figure 21: Deleting a License 








Licenses 
Feature Summary 
Feature Licenses Used Licenses Installed LicensesNeeded License Expires on 
Anti-Spam it) 1 0 2016-04-15 
IDP Signature it) 1 0 2016-04-15 
APPID Signature it) i 0 2016-04-15 
Anti Virus with Sophos Engine 0 2 it) 2016-07-29 
Web Filtering EWF it) iz 0 2016-04-15 
Virtual Appliance 1 1 0 2016-04-25 
Installed Licenses 
Add... Delete Update Update Trial Display Keys... Download Keys 
ID State Version Group Enabled Features Expiration 
£420588955 valid 4 No group information Virtual Appliance - Virtual Appliance count-down 
[J 3uNOS606279 valid 4 No group information av_key_sophos_engine - Anti Virus with Sophos Engine  date-based, 2015-02-27 - 2016-02-28 
av_key_sophos_engine - Anti Virus with Sophos Engine = date-based, 2015-04-15 - 2016-04-15 
wf_key_websense_ewf - Web Filtering EWF date-based, 2015-04-15 - 2016-04-15 
[] 3UNOS623127 valid 4 No group information —_appid-sig - APPID Signature date-based, 2015-04-15 - 2016-04-15 
idp-sig - IDP Signature date-based, 2015-04-15 - 2016-04-15 
anti_spam_key_sbl - Anti-Spam date-based, 2015-04-15 - 2016-04-15 
[] JUNOS656626 valid 4 No group information av_key_sophos_engine - Anti Virus with Sophos Engine = date-based, 2015-07-29 - 2016-07-29 
(J Junos657049 valid 4 No group information _ Virtual Appliance - Virtual Appliance date-based, 2015-07-29 - 2016-04-25 
Add... Delete Update Update Trial Display Keys... Download Keys 


3. Click Delete. 


4. Click OK to confirm your deletion as shown in Figure 22 on page 262. 


Figure 22: Delete Licenses Window 








Delete Licenses 
Are you sure you want to delete the following licenses? 


OK Cancel 
ID State Version Group Enabled Features Expiration 
JUNOS606279 valid 4 No group information _av_key_sophos_engine - Anti Virus with Sophos Engine date-based, 2015-02-27 - 2016-02-28 


The license you deleted is removed. 
Deleting a License with the CLI 
To delete a license using the CLI: 


1. From operational mode, for each license, enter the following command and specify the license ID. You 
can delete only one license at a time. 


user@host> request system license delete <license-key-identifier> 


Or you can use the following command to delete all installed licenses. 


user@host> request system license delete all 


2. Type yes when you are prompted to confirm the deletion. 


Delete license JUNOS606279 ? [yes,no] (no) 


The license you deleted is removed. 


License Warning Messages 


You must purchase a new license or renew your existing subscription-based license to have a seamless 


transition from the old license to the new one. 


The following conditions occur when a license expires on vSRX: 


Evaluation license for the core expires—Packet forwarding on vSRX is disabled. However, you can manage 
vSRX through the fxpO management interface, and the CLI configuration is preserved. 


Subscription-based licenses for advanced security features expire but subscription-based licenses for 
core services are active—A 30-day grace period begins, allowing the user to continue using advanced 
security features. After the grace period, advanced security features are disabled. Basic features are 
always available in the vSRX. After subscription-based licenses for core services expire, a warning message 
is displayed to notify the user, but basic features will remain preserved for the user. 


Subscription-based license for core features expires but subscription-based license for advanced security 
features is active—A warning message is displayed to notify the user. However, you can continue to use 
the basic features on the vSRX. Advanced security features are disabled when the subscription-based 
license for advanced security features expires, but basic features will remain preserved for the user. 


All advanced and premium licenses are offered as subscriptions. Subscription licenses are available in 1 


year, 3 years, or 5 years terms. After the order fulfilment, the subscription period begins after the completion 


of 30 days grace period. 


Table 3 on page 4 describes the subscription terms for purchase and number of months to use the license. 


Table 113: Subscription Terms Details 


Subscription Terms Number of Months for the License 


1 year 13 months 
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Table 113: Subscription Terms Details (continued) 


3 years 37 months 


5 years 61 months 
All subscription licenses are renewable. To renew a subscription license, purchase a new subscription of 
the same license. For more information, see Subscription - Register and Install . 


To use features that require a license, you must install and configure a license. After the license expires, 
warning messages are displayed in the system log and on the J-Web dashboard. 


When a license expires, the System Alarms section of the J-Web dashboard displays a message stating 
that the license has expired as shown in Figure 23 on page 264. 


Figure 23: J-Web Dashboard for License Expiry Warning 


System Alarms 


Received At Severity Description Action 
2016-03-28 08:00:51 CST [Minor] License for feature Virtual Applianc... 
2016-03-04 23:49:13 CST [Minor] Rescue configuration is not set Set rescue Cc... 


When a license expires, the following message appears when you log in: 


Virtual Appliance License is invalid 


vSRX License Model Numbers 


The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of features. 
Each license includes a list of features that the license enables along with information about those features. 


For information about purchasing software licenses, contact your Juniper Networks sales representative 
at https://www.juniper.net/in/en/contact-us/. 


vSRX licenses are based on application packages and processing capacity. 


vSRX provides bandwidth in the following capacities (throughput per instance): 1 Gbps, 2 Gbps, and 4 
Gbps. Each of these bandwidth tiers is offered with three different packages. 


Table 114 on page 265 describes the features available with the various license packages. 


Table 114: vSRX Licensing Package Types 


License 
Type Description 


STD Includes the following features: 


e Core security—firewall, ALG, screens, 
user firewall 


e IPsec VPN (site-to-site VPN) 
e NAT 
e CoS 


e Routing services—BGP, OSPF, DHCP, 
J-Flow, IPv4 


e Foundation—Static routing, 
management (J-Web, CLI, and 
NETCOMF), on-box logging, 
diagnostics 


ASCB Includes all STD features bundled with 
IPS and Appsecure signatures, along 
with the following features: 


e AppID 

e AppFW 
e AppQoS 
e AppTrack 


License Model Number 


These Standard (STD) bandwidth SKUs are available for vSRX: 


e VSRX-1G-STD-CLD-1: 1-Gbps throughput (1-year 
subscription) 

e VSRX-1G-STD-CLD-3: 1-Gbps throughput (3-year 
subscription) 

e VSRX-2G-STD-CLD-1: 2-Gbps throughput (1-year 
subscription) 

e VSRX-2G-STD-CLD-3: 2-Gbps throughput (3-year 
subscription) 

e VSRX-4G-STD-CLD-1: 4-Gbps throughput (1-year 
subscription) 

e VSRX-4G-STD-CLD-3: 4-Gbps throughput (3-year 
subscription) 


These AppSecurity Bundled (ASB) bandwidth SKUs are 
available for vSRX: 


e VSRX-1G-ASB-CLD-1: 1-Gbps throughput (1-year 
subscription) 

e VSRX-1G-ASB-CLD-3: 1-Gbps throughput (3-year 
subscription) 

e VSRX-2G-ASB-CLD-1: 2-Gbps throughput (1-year 
subscription) 

e VSRX-2G-ASB-CLD-3: 2-Gbps throughput (3-year 
subscription) 

e VSRX-4G-ASB-CLD-1: 4-Gbps throughput (1-year 
subscription) 

e VSRX-4G-ASB-CLD-3: 4-Gbps throughput (3-year 
subscription) 


265 


Table 114: vSRX Licensing Package Types (continued) 


License 
Type Description License Model Number 
CSB Includes all STD features, along withthe | These Content Security Bundled (CSB) bandwidth SKUs are 
features bundled with ASCB, including available for vSRX: 
the addition of the following UTM 
f : e VSRX-1G-CSB-CLD-1: 1-Gbps throughput (1-year 
eatures: 
subscription) 
e Antivirus e VSRX-1G-CSB-CLD-3: 1-Gbps throughput (3-year 
e Content filtering subscription) 
e Web filtering e VSRX-2G-CSB-CLD-1: 2-Gbps throughput (1-year 
subscription) 
e VSRX-2G-CSB-CLD-3: 2-Gbps throughput (3-year 
subscription) 
e VSRX-4G-CSB-CLD-1: 4-Gbps throughput (1-year 
subscription) 
e VSRX-4G-CSB-CLD-3: 4-Gbps throughput (3-year 
subscription) 
ATP-B vSRX-1G-ATP-B bundle includes: A vSRX-1G-ATP-B-1 bundle includes: 1G Throughput, 1 year 


Subscription License for vSRX ATP package, including features 
e Juniper Sky ATP + 


in Content Security (CS) package, and Juniper SkyATP. 
e Content Security + 
e ASEC (IDP + AppFW) + 


e STD 


License stacking is allowed. So, for example, to license 3 Gbps of throughput for the standard (STD) feature 
set for 1 year, use a VSRX-1G-STD-CLD-1 license and a VSRX-2G-STD-CLD-1. 


vSRX License Model Numbers for Contrail, KVM, Microsoft Hyper-V, and VMware 


The licenses used by all Juniper Networks instances are based on SKUs, which represent lists of features. 
Each license includes a list of features that the license enables along with information about those features. 


For information about purchasing software licenses, contact your Juniper Networks sales representative 
at https://www.juniper.net/in/en/contact-us/. 


vSRX licenses are based on application packages and processing capacity. 


Bandwidth (throughput) licenses allow you to use a single instance of the software for up to the maximum 
throughput specified in the license entitlement. Throughput licenses can be combined on a single instance 
of the software so that the maximum throughput for that instance is the aggregate of all the throughput 
licenses assigned to that instance. A throughput license cannot be split across multiple instances. Throughput 
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licenses are identified in the license entitlement in megabits per second (Mbps), or gigabits per second 


(Gbps). 


vSRX provides bandwidth in the following capacities (throughput per instance): 100 Mbps, 1 Gbps, 2 Gbps, 
4 Gbps, 10 Gbps, and 20 Gbps. Each of these bandwidth tiers is offered with four different packages along 
with bandwidth based, a la carte, advanced Layer 7 security services SKUs. 


Table 115 on page 267 describes the features available with the various license packages. 


Table 115: vSRX Licensing Package Types 


License Type 


STD 


ASCB and 
ASECB 


CS-B 


Description 


Includes the following features: 


e Core security - firewall, ALG, screens, user 


firewall 
e IPsec VPN (site-to-site VPN) 
e NAT 
e CoS 
e Multicast services - IP Multicast (PIM, IGMP) 


e Routing services - BGP, OSPF, DHCP, J-Flow, 
IPv4, and IPv6é 


e High availability 


e Foundation - Static routing, management 
(J-Web, CLI, and NETCONF), on-box logging, 
diagnostics 


e Software platform - KVM, Openstack, ESXi 
6.0, Contrail 


Includes all STD features bundled with the 
following additional AppSecure features: 


e AppID 

e AppFW 
e AppQoS 
e AppTrack 


Includes all STD features bundled with ASEC 
features and the addition of UTM capabilities: 


e Antispam 
e Antivirus 
e Content filtering 


e Web filtering 


Duration 


Both perpetual and subscription license 
options are available. 


See Table 116 on page 269 for STD bandwidth 
SKUs available for vSRX. 


Subscription licenses only. 


See Table 117 on page 270 for bandwidth SKUs 
available for vSRX with AppSecure and IPS 
features. 


Subscription licenses only. 


See Table 119 on page 272 for CS-B bandwidth 
SKUs available for vSRX. 


Table 115: vSRX Licensing Package Types (continued) 


License Type 


ATP-B 


Individual (a la 
carte) 
Advanced 
Security 
Services ( 
ASEC, S-AV, 
W-EWF, CS) 


Description 


vSRX-1G-ATP-B bundle includes: 


e Sky ATP + 

e Content Security + 

e ASEC (IDP + AppFW) + 
e STD 


Individual (a la carte) Layer 7 security services 
licenses including: 


e Sophos antivirus 

e Websense enhanced Web filtering 
e AppSecure and IPS 

e Content Security (CS) 
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Duration 


A vSRX-1G-ATP-B-1 bundle includes: 1G 
Throughput, 1 year Subscription License for 
vSRX ATP package, including features in 
Content Security (CS) package, and SkyATP. 


This license is not supported for Contrail 
deployments. 


Subscription licenses only. 


See Table 118 on page 271 for AppSecure and 
IPS SKUs available for vSRX. 


See Table 121 on page 274 for Sophos antivirus 
bandwidth SKUs available for vSRX. 


Table 122 on page 275 lists the Web filtering 
subscription licenses available for vSRX. 


License stacking is allowed. For example, to license 3 Gbps of throughput for the standard (STD) feature 
set for 1 year, use a VSRX-1G-STD-1 license and a VSRX-2G-STD-1. 


Table 116 on page 269 lists the standard bandwidth licenses available for vSRX. 


Table 116: Standard (STD) vSRX Bandwidth Licenses 


STD Licenses 


100M/1G/2G/4G/10G/20G 
throughput—vSRX standard package 
(1 year, 3 years, and perpetual) 


Table 117 on page 270 lists the bandwidth licenses available for vVSRX bundled with AppSecure and IPS 


features. 


Model Number 


VSRX-100M-STD 


VSRX-100M-STD-1 


VSRX-100M-STD-3 


VSRX-1G-STD 


VSRX-1G-STD-1 


VSRX-1G-STD-3 


VSRX-2G-STD 


VSRX-2G-STD-1 


VSRX-2G-STD-3 


VSRX-4G-STD 


VSRX-4G-STD-1 


VSRX-4G-STD-3 


VSRX-10G-STD 


VSRX-10G-STD-1 


VSRX-10G-STD-3 


VSRX-20G-STD 


VSRX-20G-STD-1 


VSRX-20G-STD-3 
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Table 117: vSRX AppSecure and IPS Bundled (ASCB and ASECB) Bandwidth Licenses 


ASCB / ASECB Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-ASCB-1 


throughput—vSRX AppSecure 


package includes all features in the Mee TOME SCa 


STD package with IPS and AppSecure 


(1-year or 3-year subscription) 
VSRX-1G-ASECB-1 


VSRX-1G-ASECB-3 


VSRX-2G-ASECB-1 


VSRX-2G-ASECB-3 


VSRX-4G-ASECB-1 


VSRX-4G-ASECB-3 


VSRX-10G-ASECB-1 


VSRX-10G-ASECB-3 


VSRX-20G-ASECB-1 


VSRX-20G-ASECB-3 


Table 118 on page 271 lists the individual (a la cart) subscription licenses available for VSRX with AppSecure 
and IPS features. 
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Table 118: Individual vSRX AppSecure and IPS Subscription Licenses 


ASEC Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-ASEC-1 


subscription—vSRX AppSecure 


package includes IPS and AppSecure Ve IDOE SEG® 


(1-year or 3-year subscription) 


VSRX-1G-ASEC-1 


VSRX-1G-ASEC-3 


VSRX-2G-ASEC-1 


VSRX-2G-ASEC-3 


VSRX-4G-ASEC-1 


VSRX-4G-ASEC-3 


VSRX-10G-ASEC-1 


VSRX-10G-ASEC-3 


VSRX-20G-ASEC-1 


VSRX-20G-ASEC-3 


Table 119 on page 272 lists the Content Security Bundled (CSB) bandwidth licenses available for vSRX. 
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Table 119: vSRX Content Security Bundled (CSB) Bandwidth Licenses 


CS Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-CS-B-1 
throughput—vSRX CS package 

includes all features in STD, IPS, and 
AppSecure, enhanced Web filtering, 


VSRX-100M-CS-B-3 


Sophos antivirus, antispam, content 
filtering, (1-year or 3-year VSRX-1G-CS-B-1 


subscription). yeniaecens 


VSRX-2G-CS-B-1 


VSRX-2G-CS-B-3 


VSRX-4G-CS-B-1 


VSRX-4G-CS-B-3 


VSRX-10G-CS-B-1 


VSRX-10G-CS-B-3 


VSRX-20G-CS-B-1 


VSRX-20G-CS-B-3 


Table 120 on page 273 lists the individual (a la carte) CS subscription licenses available for vSRX. 
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Table 120: vSRX Individual Content Security (CS) Subscription Licenses 


CS Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-CS-1 
throughput—vSRX CS package 


includes enhanced Web filtering, VSRX-100M-CS-3 


Sophos antivirus, antispam, 
AppSecure and IPS (1-year or 3-year 
subscription). VSRX-1G-CS-1 


VSRX-1G-CS-3 


VSRX-2G-CS-1 


VSRX-2G-CS-3 


VSRX-4G-CS-1 


VSRX-4G-CS-3 


VSRX-10G-CS-1 


VSRX-10G-CS-3 


VSRX-20G-CS-1 


VSRX-20G-CS-3 


Table 121 on page 274 lists the individual (a la carte) Sophos antivirus (S-AV) bandwidth licenses available 
for vSRX. 
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Table 121: vSRX Individual Sophos Antivirus (S-AV) Bandwidth Licenses 


S-AV Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-S-AV-1 
throughput—vSRX S-AV license 


(1-year or 3-year subscription). Ve TOM as 


VSRX-1G-S-AV-1 


VSRX-1G-S-AV-3 


VSRX-2G-S-AV-1 


VSRX-2G-S-AV-3 


VSRX-4G-S-AV-1 


VSRX-4G-S-AV-3 


VSRX-10G-S-AV-1 


VSRX-10G-S-AV-3 


VSRX-20G-S-AV-1 


VSRX-20G-S-AV-3 


Table 122 on page 275 lists the individual (a la carte) enhanced Web filtering (W/-EWF) subscription licenses 
available for vSRX. 


Table 122: vSRX Individual Enhanced Web Filtering (W-EWF) Bandwidth Licenses 


W-EWF Licenses Model Number 


100M/1G/2G/4G/10G/20G VSRX-100M-WEWF-1 
throughput—vSRX W-EWF license 


(1-year or 3 year subscription). VERS DOOM ENNIS 


VSRX-1G-W-EWF-1 


VSRX-1G-W-EWF-3 


VSRX-2G-W-EWF-1 


VSRX-2G-W-EWF-3 


VSRX-4G-W-EWF-1 


VSRX-4G-W-EWF-3 


VSRX-10G-W-EWF-1 


VSRX-10G-W-EWF-3 


VSRX-20G-W-EWF-1 


VSRX-20G-W-EWF-3 


Table 123 on page 275 lists the remote access licenses you can purchase for vSRX. 


Table 123: vSRX Remote Access Licenses 


Remote Access Licenses Model Number 
Remote Access (5 Concurrent users, NCP) vSRX-RA1-5 
Remote Access (10 Concurrent users, NCP) vSRX-RA1-10 
Remote Access (25 Concurrent users, NCP) vSRX-RA1-25 


Remote Access (50 Concurrent users, NCP) vSRX-RA1-50 
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Table 123: vSRX Remote Access Licenses (continued) 


Remote Access Licenses 


Remote Access (100 Concurrent users, NCP) 


Remote Access (150 Concurrent users, NCP) 


Remote Access (250 Concurrent users, NCP) 


Remote Access (500 Concurrent users, NCP) 


| Licenses for Advanced Threat Prevention 


IN THIS SECTION 


@ Licenses for JATP Advanced Threat Prevention Appliance | 276 
@ Licenses for Juniper Sky Advanced Threat Prevention (ATP) | 280 


Licenses for JATP Advanced Threat Prevention Appliance 


IN THIS SECTION 


@ Licensing and Platform Support information | 276 
@ Setting the Juniper ATP Appliance License Key | 278 


Licensing and Platform Support information 


IN THIS SECTION 


@ JATP and SRX Series Integration Licensing | 277 
@ Supported SRX Series Devices | 277 
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Model Number 


vSRX-RA1-100 


VSRX-RA1-150 


VSRX-RA1-250 


VSRX-RA1-500 
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The following sections provide information on licensing requirements and SRX Series device platform 
support. 
JATP and SRX Series Integration Licensing 


Unlike other Layer 7 features, there is no separate license required on the SRX Series device for integration 
with JATP. In this deployment, the JATP Core is the licensed component. If the Core has a valid license, 
then the SRX Series device can connect to the Core and enroll successfully. If not, the enrollment will fail. 


For JATP license upload instructions, see “Setting the Juniper ATP Appliance License Key” on page 278. 


NOTE: AppSecure functionality on the SRX Series device is a pre-requisite for integrating with 
JATP. Depending on the SRX Series platform, a separate license may be required to enable 
AppSecure. Please consult the SRX Series platform data sheet for the most accurate information. 


Supported SRX Series Devices 


This section describes the hardware and software components that are compatible with JATP. 


Platform Hardware Requirements Software Versions 

vSRX Series Junos 18.2R1 and above 

SRX Series SRX320, SRX300 Junos 18.3R1 and above 

SRX Series SRX4100, SRX4200, SRX4600 Junos 15.1X49-D65 and above for 


SRX4100 and SRX4200 


Junos 17.4R1-S1 and above for 


SRX4600 
SRX Series SRX340, SRX345, SRX550m Junos 15.1X49-D60 and above 
SRX Series SRX5800, SRX5600, SRX5400 Junos 15.1X49-D50 and above 
SRX Series SRX1500 Junos 15.1X49-D33 and above 


The following devices support scanning SMTP e-mail attachments: 


e SRX300 Series device 
e SRX320 Series device 
e SRX340 Series device 
e SRX345 Series device 


e SRX1500 Series device 
e SRX4100 Series device 
e SRX4200 Series device 
e SRX4600 Series device 
e SRX5400 Series device 
e SRX5600 Series device 
e SRX5800 Series device 
e vSRX Series 


The following devices support scanning IMAP e-mail attachments: 


e SRX300 Series device 
e SRX320 Series device 
e SRX340 Series device 
e SRX345 Series device 
SRX1500 Series device 


SRX4100 Series device 


SRX4200 Series device 


SRX4600 Series device 


SRX5400 Series device 


SRX5600 Series device 


SRX5800 Series device 


e vSRX Series 


SEE ALSO 


Getting Started with JATP and the SRX Series Device 


Setting the Juniper ATP Appliance License Key 


Without a valid product license key, the Juniper ATP Appliance system will not work. Likewise, an expired 
product key, or an expired support or content license, prevents full operations and disables content or 
software updates. 


Use the Config>System Profiles>Licensing configuration window to upload a License key to the Juniper 
ATP Appliance or software service. To license your system, you will need to upload the license using this 
configuration window and also use the CLI to get the system UUID. 
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NOTE: License Keys are obtained from Juniper Customer Support. 


et 


Dashboard Inadents e Uploads Mitigation Reports 


Notifications 


Instalied. Expires om 2020-12-31, Enterprise License 
Instalied. Expires om 2020-12-31 
O- Password Reset Content License Installed. Expires or 2020-12-31 


System Profiles i—] 


Roles Add New Juniper Lense 


ZS Zones 

2s Users 

de SAM Settings 

© Ranius Serrings 

* System Settings 

B Certificate Managemens 
@ Gss Sectings 


> wen Couccwons 


® secondary Cores 


@ Golden trage VMs 





To upload a product license key: 


1. Navigate to the Config>System Profiles>Licensing page. 
2. Click Add New Juniper ATP Appliance License button to upload a new license key file. 


3. Click the Choose File button to select the license key for upload, then click Submit to apply the 
configuration. 


NOTE: A GSS connection is required in order for Juniper ATP Appliance to run regular 
licensing checks. Adding a license manually does not enable JATPsupport. 
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Licenses for Juniper Sky Advanced Threat Prevention (ATP) 


IN THIS SECTION 


Juniper Advanced Threat Prevention Cloud License Types | 280 
Managing the Juniper Advanced Threat Prevention Cloud License | 282 


Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking the application-identification 
License | 286 


Juniper Advanced Threat Prevention Cloud License Types 


Juniper ATP Cloud has three service levels: 


e Free—The free model solution is available on all supported SRX Series devices (see the Supported 
Platforms Guide) and for customers that have a valid support contract, but only scans executable file 
types (see Juniper Advanced Threat Prevention Cloud Profile Overview). Based on this result, the SRX Series 
device can allow the traffic or perform inline blocking. 


e Basic (feed only)—Includes executable file scanning and adds filtering using the following threat feed 
types: Command and Control, GeolP, Custom Filtering, and Threat Intel feeds. Threat Intel feeds use 
APIs that allow you to injects feeds into Juniper ATP Cloud. 


e Premium—lIncludes all features provided in the Free and Basic licenses, but provides deeper analysis. All 
supported file types are scanned and examined using several analysis techniques to give better coverage. 
Full reporting provides details about the threats found on your network. 


NOTE: On the Enrolled Devices page in the Juniper ATP Cloud Web UI, the License Expiration 
column contains the status of your current license, including expiration information. There is a 
60 day grace period after the license expires before the SRX Series device is disenrolled from 
Juniper ATP Cloud. On the SRX Series device, you can run the > show system license command 
to view license details. 


NOTE: You do not need to download any additional software to run Juniper ATP Cloud. 


Table 124 on page 281 shows a comparison between the free model and the premium model. 
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Table 124: Comparing the Juniper ATP Cloud Free Model, Basic-Threat Feed, and Premium Model 


Free Model 


Management through cloud 
interface. Zero on-premise 
footprint beyond the SRX 
Series device. 


Inbound protection. 


Outbound protection. 


Inspects only executable file 
types. Executables go through 
the entire pipeline (cache, 
antivirus, static and dynamic). 


Reporting with rich detail on 
malware behaviors. 


Basic-Threat Feeds Model 


Management through cloud 


interface. Zero on-premise footprint 


beyond the SRX Series device. 


Inbound protection. 


Outbound protection. 


C&C feeds. 


GeolP filtering. 


Custom feeds 


Threat Intelligence APIs only 


Inspects only executable file types. 
Executables go through the entire 
pipeline (cache, antivirus, static and 
dynamic). 


Reporting with rich detail on 
malware behaviors. 


Premium Model 


Management through cloud interface. Zero 


on-premise footprint beyond the SRX Series 


device. 


Inbound protection. 


Outbound protection. 


C&C feeds. 


GeolP filtering. 


Custom feeds 


Infected host feed/endpoint quarantine 


All APIs including File/Hash 


C&C protection with event data returned 
to the Juniper ATP Cloud. 


Compromised endpoint dashboard. 


No restrictions on object file types 
inspected beyond those imposed by the 
Juniper ATP Cloud service. You can specify 
which file types are sent to service for 
inspection. 


Reporting with rich detail on malware 
behaviors. 


For more information on analysis techniques, see How is Malware Analyzed and Detected?. For additional 


information on product options, see the Juniper ATP datasheet. 


For more information on this and premium license SKUs, contact your local sales representative. 
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Additional License Requirements 


AppSecure functionality on the SRX Series device is a pre-requisite for the Juniper Advanced Threat 
Prevention Cloud feature. Depending on the SRX Series platform, a separate license may be required to 
enable AppSecure. Please consult the SRX Series platform datasheet for the most accurate information. 


Managing the Juniper Advanced Threat Prevention Cloud License 


IN THIS SECTION 


Obtaining the Premium License Key | 282 
License Management and SRX Series Devices | 283 
Juniper ATP Cloud Premium Evaluation License for vSRX | 283 


License Management and vSRX Deployments | 284 


High Availability | 285 


This topic describes how to install the Juniper ATP Cloud premium license onto your SRX Series devices 
and vSRX deployments. You do not need to install the Juniper ATP Cloud free license as these are included 
your base software. Note that the free license has a limited feature set (see Juniper Advanced Threat 
Prevention Cloud License Types and File Limitations). 


When installing the license key, you must use the license that is specific your device type. For example, 
the Juniper ATP Cloud premium license available for the SRX Series device cannot be used on vSRX 
deployments. 


Obtaining the Premium License Key 


The Juniper ATP Cloud premium license can be found on the Juniper Networks product price list. The 
procedure for obtaining the premium license entitlement is the same as for all other Juniper Network 
products. The following steps provide an overview. 


1. Contact your local sales office or Juniper Networks partner to place an order for the Juniper ATP Cloud 
premium license. 


After your order is complete, an authorization code is e-mailed to you. An authorization code is a unique 
16-digit alphanumeric used in conjunction with your device serial number to generate a premium license 
entitlement. 


2. (SRX Series devices only) Use the show chassis hardware CLI command to find the serial number of 
the SRX Series devices that are to be tied to the Juniper ATP Cloud premium license. 


[edit] 
root@SRX# run show chassis hardware 


Hardware inventory: 

















Item Version Part number Serial number Description 
Chassis CM1915AK0326 SRX1500 
Midplane REV 09 750-058562 ACMH15 90 SRX1500 
Pseudo CB 0 
Routing Engine 0 BUILTIN BUILTIN SRX Routing Engine 
FPC 0 REV 08 AROS Sis 2 ACMG3280 FEB 
ewe ©) BUILTIN BUILTIN 12x1G-T-4x1G—-SFP-4x10G 


Look for the serial number associated with the chassis item. In the above example, the serial number 
is CM1915AK0326. 


3. Open a browser window and go to https://license.juniper.net. 


4. Click Login to Generate License Keys and follow the instructions. 


NOTE: You must have a valid Juniper Networks Customer Support Center (CSC) account to 
log in. 


License Management and SRX Series Devices 


Unlike other Juniper Networks products, Juniper ATP Cloud does not require you to install a license key 
onto your SRX Series device. Instead, your entitlement for a specific serial number is automatically 
transferred to the cloud server when you generate your license key. It may take up to 24 hours for your 
activation to be updated in the Juniper ATP Cloud cloud server. 


Juniper ATP Cloud Premium Evaluation License for vSRX 


The 30-day Juniper ATP Cloud countdown premium evaluation license allows you to protect your network 
from advanced threats with Juniper ATP Cloud. The license allows you to use Juniper ATP Cloud premium 
features for 30-days without having to install a license key. After the trial license expires, the connection 
to the Juniper ATP Cloud cloud is broken and you will no longer be able to use any Juniper ATP Cloud 
features. 


Instructions for downloading the trial license are here: https://www.juniper.net/us/en/dm/free-vsrx-trial/. 
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NOTE: The 30-day trial license period begins on the day you install the evaluation license. 


To continue using Juniper ATP Cloud features after the optional 30-day period, you must purchase 
and install the date-based license; otherwise, the features are disabled. 


After installing your trial license, set up your realm and contact information before using Juniper ATP 
Cloud. For more information, see Registering a Juniper Advanced Threat Prevention Cloud Account. 


License Management and vSRX Deployments 


Unlike with physical SRX Series devices, you must install Juniper ATP Cloud premium licenses onto your 
vSRX. Installing the Juniper ATP Cloud license follows the same procedure as with most standard vSRX 
licenses. 


The following instructions describe how to install a license key from the CLI. You can also add a new license 
key with J-Web (see Managing Licenses for vSRX.) 


NOTE: If you are reinstalling a Juniper ATP Cloud license key on your vSRX, you must first 
remove the existing Juniper ATP Cloud license. For information on removing licenses on the 
vSRX, see Managing Licenses for vSRX. 


To install a license key from the CLI: 


1. Use the request system license add command to manually paste the license key in the terminal. 


user@vsrx> request system license add terminal 


[Type *D at a new line to end input, 


enter blank line between each license key] 


JUNOS123456 aaaaaa bbbbbb cccccc dddddd eeeecee FELEFE 
cccccc bbbbbb dddddd aaaaaa ffffff aaaaaa 
aaaaaa bbbbbb cccccc dddddd eeeeee ffFLLffEF 
cccccc bbbbbb dddddd aaaaaa fffffFf 


JUNOS123456: successfully added 


add license complet (no errors) 
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NOTE: You can save the license key to a file and upload the file to the vSRX file system 
through FTP or Secure Copy (SCP), and then use the request system license add file-name 


command to install the license. 


2. (Optional) Use the show system license command to view details of the licenses. 


Example of a premium license output: 


root@host> show system license 





License identifier: JUNOS123456 





License version: 4 


Software Serial Number: 1234567890 
Customer ID: JuniperTest 


Features: 
Sky ATP = Siky Ales 





Cloud Based Advanced Threat Prevention on SRX 


firewalls 
daceloased, 20ILG-O7—-L9 I7sOQOsO0 Pda = ZOISG—-O7—30 17200200 ww 


Example of a free license output: 


root@host> show system license 





License identifier: JUNOS123456 





License version: 4 


Software Serial Number: 1234567890 
Customer ID: JuniperTest 


Features: 
Virtual Appliance —- Virtual Appliance permanent 


3. The license key is installed and activated on your vSRX. 


High Availability 

Before enrolling your devices with the Juniper ATP Cloud cloud, set up your HA cluster as described in 
your product documentation. For vSRX deployments, make sure the same license key is used on both 
cluster nodes. When enrolling your devices, you only need to enroll one node. The Juniper ATP Cloud 
cloud will recognize this is an HA cluster and will automatically enroll the other node. 
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Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking the application-identification License 


If you are using an SRX1500 Series device, you must have a have a valid application-identification license 
installed. Use the show services application-identification version CLI command to verify the applications 
packages have been installed. You must have version 2540 or later installed. For example: 


user@host> show services application-identification version 


Application package version: 2540 


If you do not see the package or the package version is incorrect, use the request services 
application-identification download CLI command to download the latest application package for Junos 
OS application identification. For example: 


user@host> request services application-identification download 


Please use command "request services application-identification download status" to check status 


Then use the request services application-identification install CLI command to install the downloaded 
application signature package. 


user@host> request services application-identification install 


Please use command "request services application-identification install status" to check status 


Use the show services application-identification application version CLI command again to verify the 
applications packages is installed. 
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Viewing Licenses With Edge Services Director 


Juniper Networks devices require a license to operate some features. You can view the licenses for devices 
connected to Edge Services Director. 


To view the license for a Juniper Networks device on your network: 


1. Select the Build icon in the Edge Services Director banner. 


2. In the View pane, select a wireless or wired device. 


3. In the Tasks pane, select View License Information. 
The Licenses page for that object is displayed with the fields listed in Table 125 on page 288. 


Table 125: Viewing Licenses with Edge Services Director 


Field Description 


Feature Name Name of the licensed SKU or feature. It can be used to look up the license 
with Juniper Networks. Not all devices support this. 


License Count Number of times an item has been licensed. This value can have 
contributions from more than one licensed SKU or feature. Alternatively, 
it can be 1, no matter how many times it has been licensed. 


Used Count Number of times the feature is used. For some types of licenses, the license 
count will be 1, no matter how many times it is used. For capacity-based 
licensable items, if infringement is supported, the license count can exceed 
the given count, which has a corresponding effect on the need count. 


Need Count Number of times the feature is used without a license. Not all devices can 
provide this information. 


Given Count Number of instances of the feature that are provided by default. 


If a device does not have a license, a blank page is displayed with the message, No license is installed 
on this device. If you are sure the device has a license, try resynchronizing the device before displaying 
the license again. 


4. Optionally, expand the license information by feature name to view the feature SKU information. 
Table 126 on page 289 describes the additional fields that are displayed. 
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Table 126: Additional Licensing Information 


Field 


Validity Type 


License Name 


License Version 


License State 


Time Remaining 


Start Date 


End Date 


Original Time Allowed 


Description 


Validity type can be Databased (license expires on end date), Permanent, 
Countdown (license expires when time remaining is zero), or Trial. If the 
validity type is either Databased or Countdown, more information is 
displayed—License Name, License Version, License State, and Time 
Remaining. Additional information can be added in the details grid based 
on the SKU type (SKU or Feature)—Start Date, End Date, or Original Time 
Allowed. 


If the validity type is either Databased or Countdown, the identifier 
associated with a license key is displayed. 


If the validity type is either Databased or Countdown, the version of a 
license is displayed. The version indicates how the license is validated, the 
type of signature, and the signer of the license key. 


If the validity type is either Databased or Countdown, the state of the 
license is displayed—Valid, Invalid, or Expired. 


If the validity type is either Databased or Countdown, the remaining time 
left on the license is displayed. For a trial license, the number of days 
remaining after you installed the device is displayed. For a commercial 
license, the time remaining is unlimited. 


Based on the SKU type, the start date of the license can be displayed in 
the details grid. 


Based on the SKU type, the end date of the license can be displayed in 
the details grid. 


Based on the SKU type, the original license timeframe can be displayed 
here. 


If you apply a new license to an existing device, you must resynchronize the device before the new license 


is seen in Edge Services Director. For directions, see Resynchronizing Device Configuration. 


SEE ALSO 


Understanding the Edge Services Director User Interface 
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Viewing Licenses With Connectivity Services Director 


Juniper Networks devices require a license to operate some features. You can view the licenses for devices 
connected to Connectivity Services Director. 


To view the license for a Juniper Networks device on your network: 


1. Select the Build icon in the Connectivity Services Director banner. 


2. In the View pane, select a device. 


3. In the Tasks pane, select View License Information. 
The Licenses page for that object is displayed with the fields listed in Table 127 on page 290. 


Table 127: Viewing Licenses with Connectivity Services Director 


Field Description 


Feature Name Name of the licensed SKU or feature. It can be used to look up the license 
with Juniper Networks. Not all devices support this. 


License Count Number of times an item has been licensed. This value can have 
contributions from more than one licensed SKU or feature. Alternatively, 
it can be 1, no matter how many times it has been licensed. 


Used Count Number of times the feature is used. For some types of licenses, the license 
count will be 1, no matter how many times it is used. For capacity-based 
licensable items, if infringement is supported, the license count can exceed 
the given count, which has a corresponding effect on the need count. 


Need Count Number of times the feature is used without a license. Not all devices can 
provide this information. 


Given Count Number of instances of the feature that are provided by default. 


If a device does not have a license, a blank page is displayed with the message, No license is installed 
on this device. If you are sure the device has a license, try resynchronizing the device before displaying 
the license again. 


If you apply a new license to an existing device, you must resynchronize the device before the new license 
is seen in Connectivity Services Director. For directions, see Resynchronizing Device Configuration. 
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Viewing Licenses With Network Director 


Juniper Networks devices require a license to operate some features. You can view the licenses for devices 
connected to Network Director. 


To view the license for a Juniper Networks device on your network: 


1. Select the Build icon in the Network Director banner. 


2. In the View pane, select a wireless or wired device. 


3. In the Tasks pane, select View License Information. 
The Licenses page for that object is displayed with the fields listed in Table 128 on page 291. 


Table 128: Viewing Licenses with Network Director 


Field Description 


Feature Name Name of the licensed SKU or feature. It can be used to look up the license 
with Juniper Networks. Not all devices support this. 


License Count Number of times an item has been licensed. This value can have 
contributions from more than one licensed SKU or feature. Alternatively, 
it can be 1, no matter how many times it has been licensed. 


Used Count Number of times the feature is used. For some types of licenses, the license 
count will be 1, no matter how many times it is used. For capacity-based 
licensable items, if infringement is supported, the license count can exceed 
the given count, which has a corresponding effect on the need count. 


Need Count Number of times the feature is used without a license. Not all devices can 
provide this information. 


Given Count Number of instances of the feature that are provided by default. 


If a device does not have a license, a blank page is displayed with the message, No license is installed 
on this device. If you are sure the device has a license, try resynchronizing the device before displaying 
the license again. 


4. Optionally, expand the license information by feature name to view the feature SKU information. 
Table 129 on page 292 describes the additional fields that are displayed. 


292 


Table 129: Additional Licensing Information 


Field 


Validity Type 


License Name 


License Version 


License State 


Time Remaining 


Start Date 


End Date 


Original Time Allowed 


Description 


Validity type can be Databased (license expires on end date), Permanent, 
Countdown (license expires when time remaining is zero), or Trial. If the 
validity type is either Databased or Countdown, more information is 
displayed—License Name, License Version, License State, and Time 
Remaining. Additional information can be added in the details grid based 
on the SKU type (SKU or Feature)—Start Date, End Date, or Original Time 
Allowed. 


If the validity type is either Databased or Countdown, the identifier 
associated with a license key is displayed. 


If the validity type is either Databased or Countdown, the version of a 
license is displayed. The version indicates how the license is validated, the 
type of signature, and the signer of the license key. 


If the validity type is either Databased or Countdown, the state of the 
license is displayed—Valid, Invalid, or Expired. 


If the validity type is either Databased or Countdown, the remaining time 
left on the license is displayed. For a trial license, the number of days 
remaining after you installed the device is displayed. For a commercial 
license, the time remaining is unlimited. 


Based on the SKU type, the start date of the license can be displayed in 
the details grid. 


Based on the SKU type, the end date of the license can be displayed in 
the details grid. 


Based on the SKU type, the original license timeframe can be displayed 
here. 


If you apply a new license to an existing wireless LAN controller, you must resynchronize the device before 


the new license is seen in Network Director. For directions, see Resynchronizing Device Configuration. 


Installing VCF Software Licenses 


To install a VCF software license: 


1. Purchase two VCF software license keys (QFX-VCF-LIC) from your Juniper Networks sales 


representative. 
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The sales representative will provide you with the feature license files and license keys. You will be 
asked to supply the chassis serial number of your switch; you can obtain the serial number by issuing 
the show virtual-chassis command. 


2. Install the first software license on one device in the VCF (for example, the device acting in the master 
role): 


user@device> request system license add (filename | url) 


3. Install the second software license on a second device in the VCF (for example, the device acting in 
the backup role): 


user@device> request system license add (filename | url) 


Junos Space License Installation Overview 


Junos Space Network Management Platform comes with a 60-day full-featured trial license. You must 
procure and install a valid license during this period to ensure continued operation beyond the trial period. 


If you fail to upload a valid license during the 60-day trial period, the Junos Space user interface displays 
an error message when you log in indicating that the license has expired. Your access is limited to the 
Licenses page (Administration > Licenses) from where you can execute the Import License task to enter 
a valid license. 


For Junos Space Platform licensing details, see Generating and Uploading the Junos Space License Key File 
and Viewing Junos Space Licenses. 


You can use either of the following options to install a valid license for Junos Space Platform: 


e If you plan to use the Junos Space Platform with only the Support Automation applications (Service Now 
and Service Insight), you can navigate to the Add Organization page (Service Now > Administration > 
Organizations > Add Organization) in the Service Now user interface to activate these applications. 
However, to activate these applications, you must have a valid support contract for your Juniper Networks 
devices and valid credentials to access the Juniper Support System (JSS) back end. 


If you choose this option and if you want to use other Junos Space applications beyond the trial period, 
you must purchase a license for Junos Space Platform (as explained in the bulleted item that follows). 


If you want to use Junos Space applications other than Service Now and Service Insight, or if you do 
not have a valid support contract for your Juniper Networks devices, you must purchase a license for 
Junos Space Platform. After you obtain the license file, you can install the license from the Import License 
page (Administration > Licenses > Import License). For more information about installing a valid license 
for Junos Space Platform, see the Generating and Uploading the Junos Space License Key File topic (in the 
Junos Space Network Management Platform Workspaces Feature Guide). 
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Exporting the License Inventory 


The Device Licence Inventory feature enables you to display the currently installed license inventory 
information for all DMI schema-based devices under Junos Space Network Management Platform 
management. 


The license inventory is generated when the device is first discovered and synchronized in Junos Space 
Network Management Platform. 


The licenses used by all Juniper Networks devices are based on SKUs, which represent lists of features. 
Each license includes a list of features that the license enables and information about those features. 
Sometimes the license information also includes the inventory keys of hardware or software elements 
upon which the license can be installed. 


To view the license(s) for Junos Space Network Management Platform itself, see Viewing Junos Space 
Licenses. 


This topic also covers: 


e Absence of license 
e Trial information 
e Count-down information 


e Date-based information 


DMI enables each device family to maintain its own license catalog in the DMI Update Repository. The 
license catalog is a flat list of all the licenses used by a device family. The key for a license element is its 
SKU name. Each license element in the catalog includes a list of features that the license enables and 
information about each feature (that is, its name and value). Optionally, the license element can also list 
the inventory keys of hardware or software elements and where it can be installed. 


If the license inventory on the device is changed, the result depends on whether the network is the system 
of record or Junos Space Network Management Platform is the system of record. See Systems of Record 
in Junos Space Overview. 


If the network is the system of record, Junos Space Network Management Platform automatically 
synchronizes with the managed device. You can also manually resynchronize the Junos Space Network 
Management Platform license database with the device by using the Resynchronize with Network action. 
See Resynchronizing Managed Devices with the Network. 


If Junos Space Network Management Platform is the system of record, neither automatic nor manual 
resynchronization is available. 


Viewing device license inventory does not include pushing license keys to devices. You can, however, push 
licenses with the Configuration Editor to any device that has license keys in its configuration. You can 
export device license inventory information to a CSV file for use in other applications. 
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License inventory information shows individually installed licenses as well as a license usage summary, 


with statistics for various features. 


To export the license inventory for a device: 


1. 


On the Network Management Platform user interface, select Devices > Device Management. 


The Device Management page displays the devices managed in Junos Space Network Management 
Platform. 


. Select Device Inventory > View License Inventory from the Actions menu. 


The License Inventory page displays the license information listed in Table 130 on page 295. 


Need Counts in red indicate violations. In other words, entries in red indicate that you are using features 
that you are not licensed to use. You may also encounter the message that you have no licenses installed. 


. (Optional) View the list of licensed features for the selected license by double-clicking a license usage 


summary or clicking on the forward action icon to the left of a license usage summary. 


The information displayed is described in Table 131 on page 296. 


. (Optional) Click Return to Inventory View at the top of the inventory page. 


. (Optional) Click Export at the top of the inventory page, to export the license inventory information. 


The Export Device License Information dialog box appears, displaying a link: Download license file for 
selected device (CSV format). 


. (Optional) Click the download link. 


The Opening Device License-xxxxxxCSV dialog box appears, where xxxxxx represents a number. 


. Open the file with an application of your choice, or download the file by clicking Save. 


The CSV file contains the fields described in Table 131 on page 296 and Table 132 on page 296. These 
fields are not populated if the information is not available for the selected license. 


Exporting device license information generates an audit log entry. 


Table 130: License Usage Summary Fields 


Field Description 


Feature name Name of the licensed SKU or feature. It can be used to look up the license with Juniper 


Networks. Not all devices support this. 
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Table 130: License Usage Summary Fields (continued) 


Field 


License count 


Used count 


Need count 


Given count 


Description 


Number of times an item has been licensed. This value may have contributions from 
more than one licensed SKU or feature. Alternatively, it may be 1, no matter how many 


times it has been licensed. 


Number of times the feature is used. For some types of licenses, the license count will 
be 1, no matter how many times it is used. For capacity-based licensable items, if 
infringement is supported, the license count may exceed the given count, which has a 
corresponding effect on the need count. 


Number of times the feature is used without a license. Not all devices can provide this 
information. 


Number of instances of the feature that are provided by default. 


Table 131: License Feature or SKU Fields 


Field 


Feature Name 


Validity Type 


Description 


Name of the licensed SKU or feature. It can be used to look up the license with Juniper 


Networks. Not all devices support this. 


The SKU or feature is considered permanent if it is not trial, count-down, or data-based. 


Table 132: Additional Fields in CSV Files 


Field 


State 


Version 


Type 


Start Date 


End Date 


Time Remaining 


Description 


Status of the license: valid, invalid, or expired. Only licenses marked as valid are 
considered when calculating the license count. 


Version of the license. 


Permanent, trial, and so on. 


Licensed feature starting date. 


Licensed feature ending date. 


Licensed feature time remaining. 


Juniper Connected Security for VMware NSX Licensing 
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VMware NSX is VMware’s network virtualization platform for the Software Defined Data Center (SDDC). 
You can add the vSRX Virtual Services Gateway as a partner security service in the VMware NSX 
environment. The vSRX security service is managed by the Junos Space Security Director and VMware 
NSX Manager to deliver a complete and integrated virtual security solution for your SDDC environment. 
The vSRX provides advanced security services (Layer 7 services), including intrusion detection and prevention 
(IDP), and application control and visibility services through AppSecure. 


The Juniper Connected Security for VMware NSX licensing includes support for Juniper’s virtual firewall 
(vSRX), Network Security services (AppSecure, IDP) and the Juniper Connected Security and Security 
Management solutions (Policy Enforcer and Security Director) for VMware NSX-based private cloud 
advanced security. 


Juniper Connected Security for VMware NSX Advanced Security Licenses 


The Juniper Connected Security for NSX Advanced Security (ADS) licenses that are available from Juniper 
Networks provide entitlement for protection of one physical CPU socket, with one vSRX instance key 
provided for each license. Typically, a VMware ESXi server has multiple CPU sockets, and each CPU socket 
has multiple cores. 


All Juniper Connected Security for NSX ADS licenses have an associated time duration; you purchase 
licenses as subscription based for a 1-year, 3-year, or 5-year duration. 


A Juniper Connected Security for NSX ADS license cannot be purchased as a perpetual (never expire) 
license. Each license is only available on a subscription basis. 


Each license includes support for the following: 


e Juniper vSRX Series Virtual Services Gateway, including: 
e Stateful L3-L4 firewall 
e Advanced Application Security (ASEC) features (such as AppID, App FW, AppQoS, and AppTrack) 
e Intrusion Detection and Prevention (IDP) 

e Juniper Security Management solutions, including: 


e Junos Space Security Director 
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e Juniper Connected Security Policy Enforcer 


The licenses available in the Juniper Connected Security for VMware NSX ADS licensing model are based 
on SKUs which represent the terms of subscription and the supported features. 


Table 115 on page 267 describes the various license packages. 
Table 133: Juniper Connected Security for VMware NSX ADS Licensing Packages 


License Model 
Number Description 


JNSX-ADS-1-1Y Juniper Connected Security for NSX Advanced Security with vSRX for 1 physical CPU 
socket - 1 Year Subscription 


The 1 year subscription license includes support for Security Director, Policy Enforcer, 
1 vSRX entitlement for 1 physical CPU socket protection with AppSecure and IDP feature 
support 


JNSX-ADS-1-3Y Juniper Connected Security for NSX Advanced Security with vSRX for 1 physical CPU 


socket - 3 Year Subscription 


The 3 year subscription license includes support for Security Director, Policy Enforcer, 
1 vSRX entitlement for 1 physical CPU socket protection with AppSecure and IDP feature 
support 


JNSX-ADS-1-5Y Juniper Connected Security for NSX Advanced Security with vSRX for 1 physical CPU 
socket - 5 Year Subscription 


The 5 year subscription license includes support for Security Director, Policy Enforcer, 
1 vSRX entitlement for 1 physical CPU socket protection with AppSecure and IDP feature 
support 


License Duration 


The Juniper Connected Security for NSX ADS license model is subscription based. A subscription license 
is an annual license that allows you to use the licensed software for the matching duration. Subscriptions 
might involve periodic downloads of content (such as for IDP threat signature files). At the end of the 
license period, you need to renew the license to continue using it. 


Subscription licenses start when you retrieve the license key or 30 days after purchase if you have not 
retrieved the license key. All subscription licenses are renewable. 


License Procurement and Installation 


To enable a Juniper Connected Security for NSX ADS license, you must purchase, install, and manage the 
license key that corresponds to the specific terms of each license. The presence of the appropriate software 
unlocking key on your virtual instance allows you to configure and use that license. 


Licenses are usually ordered when the software application is purchased, and this information is bound to 
a customer ID. If you did not order the licenses when you purchased your software application, contact 
your account team or Juniper Networks Customer Care for assistance. Licenses can be procured from the 
Juniper Networks License Management System (LMS). 


From the Junos Space Security Director you discover the NSX Manager and perform service registration 
of the vSRX VM with the NSX Manager. The NSX Manager is added as a device in Security Director and 
its inventory is synchronized with Security Director. Discovering the NSX Manager and registering vSRX 
as a security service in Security Director are described in detail in Deploying the vSRX as an Advanced 
Security Service in a VMware NSX Environment. 


As part of the service registration procedure, in the Service Manager Registration section of the Add NSX 
Manager page, you enter the license key (see Figure 24 on page 299). 


Figure 24: Service Manager Registration: Entering the License Key 





Licenses for Network and Security Manager (NSM) 
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Installing Advanced License Keys 
To access the IDP functionality on a security module, you must install both an Advanced license key and 


an IDP license key on the security device. For details on obtaining and installing a license key. 


Installing the IDP license key disables the Deep Inspection (DI) feature. 


Managing License Keys (ScreenOS Only) 


Some security devices support the activation of optional features or the increased capacity of existing 
features through the installation of license keys. You must first obtain a license key from your value-added 
reseller (VAR) or from Juniper Networks. Then you can use the NSM UI to install the license key on the 
managed device. 


After you have installed the license key on the device, the device can begin to use the new feature 
immediately. However, because the information in the license key is decoded only after it has been installed 
on the device, you must import the license key information from the device into the NSM system before 
the new feature appears in the UI. Importing license keys from the device can also resolve any license key 
mismatches between NSM and the managed device. 

Installing License Keys on a Device 

To obtain a license key: 


1. Contact the value-added reseller (VAR) who sold you the security device, or contact Juniper Networks 
directly. 


2. Provide the serial number of your device and state the feature option you want. The license key is 
generated and then sent to you in an e-mail message. 


To install the license key on a device using the NSM UI: 


1. Inthe main navigation tree, right-click the device on which you want to install the license key and select 
Admin > Install License Key. The Install License Key dialog box appears. 


2. Either copy and paste the license key into the dialog box, or click the Browse button to locate the 
license key file on your computer. 


3. Click OK. 


Importing License Key Information into NSM 


After you install a new license key on a device, either through the NSM UI or locally (through the Web UI 
or CLI) you must import that license key information into the NSM system. 


Importing license key information from a device also enables you to quickly view all license keys installed 
on a device, and the features and capacities available on the device. 


To import or view license key information: 


1. Inthe main navigation tree, right-click the device on which you want to install the licence key and select 
Admin > Import License Key Info. 
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2. Click Yes at the confirmation dialog box. The Job Information window displays the license key 
information. 


Installing Trial License Keys 


A trial license key allows you to view and evaluate NSM before purchasing the subscription. You can install 
a trial license on NSM which allows you to add up to 6025 devices on a software installation and 525 
devices on an appliance setup. You can choose trial periods of 30, 60 and 90 days. 


The Expires in (Days) field in the NSM License Information window shows the status of your license. 
When you install a trial license, NSM displays a warning that your license expires inX number of days. 
When your license expires, NSM notifies you that your trial period is over and prompts you to install a 
new license. You can proceed with the NSM GUI log in only after the installation of a valid permanent 
license. 


Generating the NSM License Key File 


In Release 2007.3 and later releases, the NSM product line uses a licensing mechanism to prevent access 
to an unlicensed copy of NSM and to enforce a limit on the maximum number of devices that can be 
managed by NSM. New installations and installations upgrading from a release prior to 2007.3 must obtain 
a license to use NSM. 


The base license supports 25 devices with high availability (HA), including devices running ScreenOS, IDP, 
or Junos OS with Enhanced Services; EX Series, Secure Access, or Infranet Controller devices; and including 
any modeled or vsys devices. For details on these devices, see the Network and Security Manager 
Administration Guide. 


To manage more than 25 devices, a license key must be purchased separately, retrieved from the Juniper 
License Management Server (LMS), and then installed onto the NSM Server or NSM appliance. 


LMS provides an interface to generate licenses based upon serial number, authorization code and installation 
ID. 


Procedures provided in the following sections use the NSM installer to generate the installation ID. 
Alternatively, you can download a utility from the Juniper Networks Software Download site for generating 
the installation ID. 


Installing NSM for the First Time 


The first time you install NSM 2007.3 or later release software only, you need to generate a license key 
file that requires an installation ID. 


NSM Trial Licenses 


You can generate a trial license for NSM for periods of 30, 60 or 90 days. The NSM License Information 
dialog box displays the validity period in the Expires in (Days) field. Licenses can only be installed or updated 
from the NSM GUI. When the trial period is over, NSM notifies you and prompts you to install a new 
license. If you install the new license, you can proceed to log in to NSM. If not, you must exit from the 
GUI. 
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Generating the License Key for an NSM Software-Only Installation 


To generate the license key file for an NSM 2007.3 or later software-only installation: 


1. 


Run the NSM installer image on the server designated for NSM. The NSM Server generates an installation 
ID. 


. Log in to the LMS system and select License key generation for NSM. 


. Enter the serial number and authorization code. 


Your serial number is printed on the paper license certificate given to you when you purchased NSM. 


Depending on the package you purchased, Juniper Networks provides an authorization code by e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. The Customer Service will validate your purchase and generate a license key file. 


. Enter the installation ID that was generated by the NSM Server. 


The LMS system generates a license key file for the SKU recorded. You can choose to download the 
license key file, or to receive it by e-mail. 


. Save the license key file to your local drive for use during installation. 


Generating the License Key for an NSM Appliance Installation 


To generate the license key file for an NSM appliance installation: 


1. 
2. 


Log in to the LMS system and select License key generation for NSM. 
Enter the serial number and authorization code. 
The serial number is on the back of the NSM appliance chassis. 


Depending on the package you purchased, Juniper Networks provides an authorization code via e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. Customer Service will validate your purchase and generate a license key. 


The LMS system generates a license key file for the SKU recorded. You can choose to download the 
license key file, or to receive it by e-mail. 


. Save the license key file to your local drive for use during installation. 


Generating the License Key for a High Availability NSM Installation 


To generate the license key file for an NSM 2007.3 or later HA installation: 


1. 


Run the NSM installer image on the server designated as your primary NSM (or primary GUI server). 
The NSM Server generates an installation ID. 


. Run the NSM 2007.3 or later installer image on the server designated as your secondary NSM (or 


secondary GUI server). The NSM Server generates an installation ID. 


. Log in to the LMS system and select License key generation for NSM. 


. Enter the serial number and authorization code of your primary NSM. 
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For an NSM appliance installation, enter the serial number of the primary server. The hardware serial 
number is located on the back of the NSM appliance chassis. 


For a software-only installation: 
a. Enter the serial number. 


The serial number of your software is printed on the paper license certificate given to you when 
you purchased NSM. If you do not have the software serial number or the LMS System fails to 
recognize the serial number, call Juniper Networks Customer Service. 


b. Enter the installation ID of the primary NSM. 


Depending on the package you purchased, Juniper Networks provides an authorization code via e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. Customer Service will validate your purchase and generate a license key. 


5. Select the Need High Availability Key check box. The LMS systems prompts you to provide the NSM 
Secondary serial number and Secondary Installation ID. 


The LMS system generates a license key file for the SKU recorded. You can choose to download the 
file, or to receive it by e-mail. 


6. Save the license key file to your local drive for use during installation. 


Upgrading to an NSM Release that Requires a License 


When you upgrade to an NSM 2007.3 or later release from a version that is older than 2007.3, you need 
to generate a license key file that requires an installation ID. 


Generating the License Key for an NSM Software-Only Upgrade 


To generate the license key file to upgrade to NSM 2007.3 or later release: 


1. Runthe NSM installer image on the server designated for NSM. The NSM Server generates an installation 
ID. 


2. Log in to the LMS system and select License key generation for NSM. 
3. Enter the serial number and authorization code. 


Your serial number is printed on the paper license certificate given to you when you purchased NSM. 
If you do not have the serial number or the LMS System fails to recognize the serial number, call Juniper 
Networks Customer Service. 


Depending on the package you purchased, Juniper Networks provides an authorization code via e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. The Customer Service will validate your purchase and generate a license key. 


4. Enter the installation ID that was generated by the NSM Server. 


5. 
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The LMS system generates a license key file for the SKU recorded. You can choose to download the 


file or to receive it by e-mail. 


Save the license key file to your local drive for use during installation. 


The NSM upgrade to 2007.3 or later release will not proceed without the license key file if NSM manages 


more than 25 devices. 


Generating the License Key for an NSM Appliance Upgrade Installation 


To generate the license key file to upgrade an NSM appliance: 


Al; 
2. 


3. 


Log in to the LMS system and select License key generation for NSM. 
Enter the hardware serial number and authorization code. 
The hardware serial number is located on the back of the NSM appliance chassis. 


Depending on the package you purchased, Juniper Networks provides an authorization code via e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. Customer Service will validate your purchase and generate a license key. 


The LMS system generates a license key file for the SKU recorded. You can choose to download the 
file or to receive it by e-mail. 


Save the license key file to your local drive for use during installation. 


The NSMXpress upgrade to 2007.3 or later release will not proceed without the license key file if NSM 


manages more than 25 devices. 


Generating the License Key File for an NSM 2007.3 or Later High Availability Upgrade Installation 


To generate the license key file to upgrade to NSM 2007.3 or later release with high availability: 


1. 


Run the NSM installer image on the server designated as your primary NSM (or primary GUI server). 
The NSM Server generates an installation ID. 


. Run the NSM 2007.3 or later installer image on the server designated as your secondary NSM (or 


secondary GUI server). The NSM Server generates an installation ID. 


. Log in to the LMS system and select License key generation for NSM. 


. Enter the serial number and authorization code of your primary NSM. 


For an NSM appliance installation, enter the serial number of the primary server. The hardware serial 
number is located on the back of the NSM appliance chassis. 


For a software-only installation: 
a. Enter the serial number. 


The serial number of your software is printed on the paper license certificate given to you when 
you purchased NSM. If you do not have the software serial number or the LMS System fails to 
recognize the serial number, call Juniper Networks Customer Service. 
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b. Enter the installation ID of the primary NSM. 


Depending on the package you purchased, Juniper Networks provides an authorization code via e-mail. 
If you received a paper license certificate, and are managing more than 25 devices, call Juniper Networks 
Customer Service. Customer Service will validate your purchase and generate a license key. 


5. Select the Need High Availability Key check box. The LMS systems prompts you to provide the NSM 
Secondary serial number and Secondary Installation ID. 


The LMS system generates a license key file for the SKU recorded. You can choose to download the 
file, or to receive it by e-mail. 


6. Save the license key file to your local drive for use during installation. 


The NSM upgrade to 2007.3 or later release will not proceed without the license key file if NSM manages 
more than 25 devices. 


Example of an NSM License File 





aS BEGIN PGP SIGNED MESSAGE----— 
Hash: SHA1 

















NSM License File (v1) 
Generated on Thu Sep 20 19:11:08 IST 2007 


Woe, Iksikeeinse islIke ais ies 
Serial Number: 0000000 Installation ID: 200003AC65C52 


Serial Number: 00000 Installation ID: ID-2 


This license fil nables the following features: 





High-Availability: Enabled 





ax-Device: 100 





Evaluation-Mode: P30D 


This license file reflects the following SKUs: 
NS-SM-ADD-50 
NS-SM-ADD-50 





SSSa4 BEGIN PGP SIGNATURE--—-—— 
Version: GnuPG v1.2.6 (GNU/Linux) 











LOCVAWUBRVJ4dCNvzZN729P/TAQI+rgQA0G7 fGLDh9VCF xb jeMrCGp+zd1AZOKUxp 
7xOrhIZnuT 9urbumyOq9ySO3o0vF jXzTJbilbnemj61Uh4bk fKpu9H4WiludqrsBvK 
iRHzGJFMBcSCCleqVOTTBZVF82wblwy+RjWLAW7 1EHKtU4 6mVPSYOvy 9vZKu/AZE 
TwO3So2hRqg= 

=DTk4 

SSS ENDL CE SSOmGh AU RE 
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If your downloaded license key file has any extra lines before "----- BEGIN PGP SIGNED MESSAGE----- : 
or after "----- END PGP SIGNATURE----- ", delete those lines before installing the license key file. 
Installing the License Key File in Various Configurations 


Instructions for installing the license key are included in the various installation chapters. 


Upgrading the License Key 


License upgrades can be purchased at any time for any supported product. After purchasing a license 
upgrade, you receive a Right to Use (RTU) certificate containing an authorization code that allows you to 
log in to the LMS system and generate a permanent license key that can be applied to the NSM product. 


Viewing License Key Information 

You can view key information about licenses, in the NSM License Information window. From the menu 
bar, selectTools > NSM License Information to view this information 

Enforcing Licenses 


The maximum number of devices allowed for NSMXpress appliance installations is 525. The maximum 
number of devices allowed for NSM software-only installations is 6025. These numbers include all modeled 
devices, vsys devices, and cluster devices. 


Each cluster member of a cluster device counts as one device. 


Even though the SKU installation is cumulative, NSM restricts the maximum number of manageable devices. 
NSM rejects the application for a license when the maximum device supported limit is reached for both 
appliance and software installations. 


If you add a device after the number of devices added reaches 90 percent of the license limit, a warning 
message appears. If you try to add an extra device after the maximum limit is reached, a dialog box appears 
with the message “Maximum number of supported devices is reached.” You are not allowed to add devices 
after reaching the license limit. you must purchase an upgrade before adding more devices. 


Licensing FAQ 
Table 134 on page 306 answers frequently asked questions about NSM licensing. 


Table 134: Licensing FAQ 


Question Answer 


Which device types does NSM count towards | NSM counts each single addition of a firewall, IDP, router, switch, 

the total device count? Secure Access, or Infranet Controller device as one device. Each cluster 
member counts as one device. Each vsys device added to a firewall 
root device counts as one device. 


Does NSM Central Manager (NS-SM-A-CM) | The NSM Central Manager does not require a license key file for 
require a license key file? installation. Enforcement is built into the product. 


Table 134: Licensing FAQ (continued) 


Question 


Are there any differences in licenses for an 
NSM appliance and software-only 
installations? 


What is the procedure to add a new license 
after the device count limit is reached? 


| already have NSM installed in my network. 
| have more than 25 devices installed on NSM. 


Do | need a license key file to upgrade to 
2007.3 or later release? 


What is the procedure to obtain the license 
key file? 


| don't have an NSM Serial number available. 


What do | do? 


Licenses for J-Web Device Manager 


IN THIS SECTION 
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Answer 


No. Both follow the same licensing scheme, but their installation 
methods are different. NSM software version uses the NSM Installer 
to install the new license. An NSM appliance uses the Web UI to install 
the license. A license can also be installed via the NSM UI after the 
base installation is completed. 


License upgrades can be purchased at any time for any supported 
product. After purchasing a license upgrade, you receive a Right to 
Use (RTU) certificate containing an authorization code that allows you 
to log in to the LMS system and generate a permanent license key 
that can be applied to the NSM product. License key updates can then 
be applied from NSM GUI from Tools > NSM License Information. 


Yes, if you are upgrading from a release that is older than 2007.3. 


For new installations, see “Installing NSM for the First Time” on 
page 301. For upgrades, see “Upgrading to an NSM Release that 
Requires a License” on page 303. 


Call Juniper Networks Customer Service. 
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This topic applies only to the J-Web Application package. 


To enable and use some Junos OS features on an EX Series switch, you must purchase, install, and manage 
separate software licenses. Each switch requires one license. For a Virtual Chassis deployment, two licenses 
are recommended for redundancy. After you have configured the features, you see a warning message if 
the switch does not have a license for the feature. 


Before you begin managing licenses, be sure that you have: 


e Obtained the needed licenses. For information about how to purchase software licenses, contact your 
Juniper Networks sales representative. 


e Understand what makes up a license key. For more information, see “License Key Components for the 
EX Series Switch” on page 179. 


This topic includes the following tasks: 


Adding New Licenses 


To add one or more new license keys on the switch, with the J-Web license manager: 


1. In the J-Web interface, select Maintain > Licenses. 


2. Under Installed Licenses, click Add to add a new license key or keys. 


3. Do one of the following, using a blank line to separate multiple license keys: 


e Inthe License File URL box, type the full URL to the destination file containing the license key or 
keys to be added. 


e Inthe License Key Text box, paste the license key text, in plain-text format, for the license to be 
added. 


4. Click OK to add the license key or keys. 
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A list of features that use the license key is displayed. The table also lists the ID, state, and version of the 
license key. 


Deleting Licenses 


To delete one or more license keys from a switch with the J-Web license manager: 


1. In the J-Web interface, select Maintain > Licenses. 


2. Select the check box of the license or licenses you want to delete. 


3. Click Delete. 
Displaying License Keys 
To display the license keys installed on a switch with the J-Web license manager: 


1. In the J-Web interface, select Maintain > Licenses. 


2. Under Installed Licenses, click Display Keys to display all the license keys installed on the switch. 


A screen displaying the license keys in text format appears. Multiple licenses are separated by a blank line. 


Downloading Licenses 


To download the license keys installed on the switch with the J-Web license manager: 


1. In the J-Web interface, select Maintain > Licenses. 


2. Under Installed Licenses, click Download Keys to download all the license keys installed on the switch 
to a single file. 


3. Select Save it to disk and specify the file to which the license keys are to be written. You can also 
download the license file to your system. 
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About the Device License Files Page 


To access this page, click Administration > Licenses> Device Licenses. 


You can use the Device License Files page to upload licenses for devices and virtual network services from 
your local file system. Each device license file should contain only one license key. A license key is required 
to enable various features including virtual network services such as application-based routing, application 
monitoring, and vSRX security features. 


Tasks You Can Perform 
You can perform the following tasks from this page: 
e Add device license files. See Uploading a License File. 


e Edit and delete device license entries. See “Editing and Deleting Device Licenses” on page 312. 
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Push licenses to devices. See “Pushing a License to Devices” on page 314. 


View details of a device license. Click the details icon that appears when you mouse over the row for 


each license file or click More > Details. See Viewing Object Details. 


Show or hide columns about the device license files. 


e Sort the device license files. See Sorting Objects. 


Field Descriptions 


Search an object about the device license files. See Searching for Text in an Object Data Table. 


Table 135 on page 311 describes the fields on the License Files page. 


Table 135: Fields on the License Files Page 


Field 


File Name 


Description 


Tenant 


Uploaded By 


Uploaded 


Devices 


Description 


Displays the filename of the license. 


Example: license_Image_v1.txt 


Displays the description of the license. 


Example: License file for application routing. 


Displays the name of the tenant if the license is associated with a tenant. 


Example: Tenant 1 


Displays the administrator who uploaded the license. 


Example: test_admin 


Displays the date and time when the license was uploaded. 


Example: Jun 5, 2018, 12:41:08 PM 


Displays the number of devices to which the license is pushed. 


Click the number to view the devices to which the license is pushed. 
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Uploading a Device License File 


To upload a device license file: 


1. 


Click Administration > Licenses > Device Licenses. 


The Device License Files page appears. 


. Click the plus icon (+). 


The Add Device Licenses page appears. 


. In the Device License File field, specify the location of the license file that you want to upload. 


Alternatively, you can click Browse to navigate to the file location and select the file. 


NOTE: Each license file should contain only one license key. 


. (Optional) From the Tenants list, select the tenant to which you want to associate the license file. 


If you associate a license with a tenant, you can apply that license only to devices that belong to that 
tenant. If a tenant has licenses associated with the tenant, when a device is activated during ZTP, a 
matching license from the licenses associated with the tenant is downloaded to the device. 


You can apply a license that is not associated with a tenant to any device of any of the tenants. During 
ZTP, when a device is activated for a tenant that does not have any license associated with it, a matching 
license from the licenses that are not associated with any tenant is downloaded to the device. 


. In the Description field, enter a description for the license that you want to upload. 


. Click OK to upload the license. 


You are returned to the Device License Files page. 
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The following sections describe the procedure for editing and deleting uploaded device licenses: 


Editing a Device License Entry 


You can edit a device license entry to modify the description for the license file. 


1. 


Click Administration > Licenses > Device Licenses. 


The Device License Files page appears. 


. Select the device license for which you want to modify the description and click the Edit icon. 


The Update Device License page appears. 


. Update the description. 


. Click OK to save the changes. To discard the changes, click Cancel. 


If you click Cancel, a confirmation message appears. Click Yes to confirm that you want to cancel the 
update. 


Deleting a Device License 


To delete a device license: 


1. 


Click Administration > Licenses > Device Licenses. 


The Device License Files page appears. 


. Select the device license that you want to delete and click the delete icon. 


. In the confirmation message, click Yes to delete the device license. 


To cancel the delete operation, click No. 
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Pushing a License to Devices 


You can push licenses on to devices from the Licenses page of the Administration portal. If a license is 
associated with a tenant, you can push that license only to devices associated with that tenant. However, 
if no tenant is associated with a license, you can apply the license to any device that belongs to any tenant. 


When a license is applied to a device, the license information is added to the device object. When the 
same license is pushed to the device again, the a device-level error message is created. Similarly, if a pushed 
license does not match a device, the device generates an error message. 


To push a license to a device: 


1. Click Administration > Licenses > Device Licenses. 


The License Files page appears. 


2. Select the license that you want to push to a device. 


The Push License button is enabled. 


3. Click the Push License button. 


The Push License page appears. 


4. From the Tenants list, select the tenant associated with the site and devices to which you want to apply 
the license. 


NOTE: If the license has already been associated with a tenant, you cannot select a different 
tenant. You can apply the license only to the sites and devices associated with the tenant. 


Sites and devices associated with the selected tenant appear. 


5. Select the sites and devices to which you want to apply the license and click Push Licenses. 


CSO applies the license to the selected devices. 


About the CSO Licenses Page 


To access this page, click Administration > Licenses > CSO Licenses. 


Users with the OpCo Administrator role can use the CSO Licenses page to view information about the 
CSO licenses issued by the SP administrator, assign the licenses to one or more tenants, and update or 
unassign license assignments. 
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Tasks You Can Perform 


You can perform the following tasks from this page: 


e Assign CSO licenses to one or more tenants—See “Assign CSO Licenses, and Update or Unassign CSO 
License Assignments” on page 316. 


e View the tenants previously assigned to a CSO license—Click assigned-number corresponding to a license. 
The View Assigned page appears displaying the tenants and quantity assigned to each tenant. 


e Update or unassign CSO license assignments—See “Assign CSO Licenses, and Update or Unassign CSO 
License Assignments” on page 316. 


e Search for CSO licenses by using keywords—Click the search icon and enter the search term in the text 
box and press Enter. The search results are displayed on the same page. 


You can search using license SKU, sales order, type, tier, or device class. 


e Sort CSO licenses—Click a column name to sort based on the column name. 


NOTE: Sorting is applicable only to some fields. 


e Show or hide columns—Click the Show Hide Columns icon at the top right corner of the page and select 
the columns that you want displayed on the CSO Licenses page. 


Field Descriptions 


Table 136 on page 315 describes the fields on the CSO Licenses page. 


Table 136: Fields on the CSO Licenses page 


Field Description 

License SKU Displays the license SKU name; for example, 
S-CSO-C-S1-A-3. 

Sales Order Sales order number; for example, 15563238. 

Type Type of site—on-premise or cloud. 

Tier Support tier associated with the license; for example, 
Standard. 

Device Class Class of the Juniper device associated with the license; for 


example, B-class. 


316 


Table 136: Fields on the CSO Licenses page (continued) 


Field Description 


SSRN Software support reference number, which is necessary 
to identify your purchase order when you contact Juniper 


Networks for support 


Start Date Date (in MMM DD, YYYY format) from which the license 
is valid; for example, Aug 29, 2019. 


End Date Date (in MMM DD, YYYY format) up to which the license 
is valid. CSO calculates the end date based on the validity 
of the license SKU. 


Device Quantity Total number of devices (that the tenant can add) that you 
can assign for a license. 


Available Available number of devices (that the tenant can add) that 
you can assign to tenants. 


Assigned Number of devices (that the tenant can add) that are 
already assigned to one or more tenants: 


e Click assigned-number to view the tenants and quantity 
assigned for each tenant. The View Assigned page 
appears displaying the tenants and quantity assigned to 
each tenant. 


e If the CSO license is not assigned to any tenants, click 
Assign to assign the license to one or more tenants. See 
“Assign CSO Licenses, and Update or Unassign CSO 
License Assignments” on page 316. 
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Users with the Operating Company (OpCo) Administrator role can: 
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e Assign a CSO license to one or more tenants. 
e Update the assignment of a CSO license that was previously assigned to one or more tenants. 


e Unassign a CSO license that was previously assigned to a tenant. 
Assign CSO Licenses to Tenants 
To assign a CSO license that is not yet assigned to a tenant: 


1. Select Administration > Licenses > CSO Licenses. 


The CSO Licenses page appears. 


2. Click the Assign link corresponding to the license that you want to assign (in the Assigned column). 


The Assign CSO License page appears. 
3. Configure the fields according to the guidelines provided in Table 137 on page 317. 


4. Click Assign. 
CSO validates the quantities that you assigned against the total quantity for the license: 


e If the sum of assigned quantities is greater than the total quantity, an error message is displayed. You 
must then modify the assigned quantities to proceed. 


e If the sum of assigned quantities is less than or equal to the total quantity, a job is triggered. You are 
returned to the CSO Licenses page and a confirmation message is displayed on the top of the page. 
After the job completes successfully, the CSO Licenses page displays the updated information in the 
Available and Assigned columns. 


Table 137: Fields on the Assign CSO License page 
Field Description 


License Information Displays the following information for the license: 


e Sales Order 
e License SKU 
e Start Date 


License Assignment 
Device Quantity Displays the total quantity that can be assigned to tenants. 


Available Displays the available quantity that can be allocated to tenants. 


318 


Table 137: Fields on the Assign CSO License page (continued) 


Field Description 


Tenants List To assign the license to one or more tenants: 


1. Click the + icon. 


A row is added in the grid and selected. 
2. Inthe Tenant column, select the tenant to which you want to assign the license. 


3. Inthe Device Quantity column, enter the quantity that you want to assign to the 
tenant. 


A. Click ¥v (check mark) to save your changes. 


5. (Optional) Click the pencil icon to modify the tenant name or the quantity and click 
Vv (check mark) to save your changes. 


6. (Optional) Repeat the steps if you want to assign the license to additional tenants. 


Update or Unassign CSO License Assignments 


For a CSO license that is already assigned to one or more tenants, to update or unassign the license 
assignment: 


1. Select Administration > Licenses > CSO Licenses. 


The CSO Licenses page appears. 


2. Select the license for which you want to update or unassign the license assignment and click the Update 
Assignment button. 


The Assign CSO License page appears. 


3. From the list of tenants displayed in the grid, select the tenant (row) and do one of the following: 
e To update the license assignment: 


a. Click the edit (pencil) icon. 


b. In the Device Quantity column, modify the device quantity. 


c. Click ¥v (check mark) to save your changes. 


The modification that you made is displayed in the grid. 
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e To unassign the license assignment: 
a. Click the delete (trash can) icon. 


A popup appears asking you to confirm the unassign operation. 


b. Click Yes. 


The license is unassigned from the tenant that you selected and the tenant is removed from the 


grid. 


4. (Optional) If the available quantity is non-zero, you can assign the license to additional tenants. See 


Table 137 on page 317 for more information. 


5. Click Assign. 
CSO validates the modifications against the total device quantity for the license: 


e If the sum of assigned quantities is greater than the total quantity, an error message is displayed. You 
must then modify the assigned quantities to proceed. 


e If the sum of assigned quantities is less than or equal to the total quantity, a job is triggered and you 
are returned to the CSO Licenses page. A confirmation message is displayed on the top of the page. 


After the job completes successfully, the CSO Licenses page displays the updated information in the 
Available and Assigned columns. 
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| Obtaining License Keys 


You must have a unique single-seat software license key for each server installation and for each optional 
module that you want to activate. 


If you are installing Session State Register, you need a license for each SBR Carrier server, each optional 
module, and a Starter Kit license—a single number that is used on all four servers in the Starter Kit cluster. 
If you are installing more nodes than in the Starter Kit, each additional SBR Carrier server, Expansion Kit, 
and Management Node kit require unique licenses. 


When a license for the base product or an optional module is purchased, a certificate containing an 
authorization code is issued. Use the authorization code to generate a license key on the Juniper Networks 


support server. 


1. Go to https://www.juniper.net/Icrs/license.do. You may be prompted to log in. 


2. On the Manage Product Licenses screen, select SBR Carrier from the drop-down list and click Go. 
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3. Enter the authorization code from your certificate and the registered E-mail address. (The E-mail address 
is used only for account verification at this point; you can elect not to receive the license through E-mail 
in the next step.) 


English e0| fitk FAM 


JUNIPer | Pega, 


NETWORKS 


Home Solutions Products & Services Education Partners Company ContactUs How to Buy 





Home > Support > CSC > Manage Product Licenses > Generate Licenses- SBR/DAC/IMS AAA (formerly Funk) Products 











» Generate Licenses GENERATE LICENSE KEYS: SBR AND IMS AAAAND OAC PRODUCTS (FORMERLY FUNK) 


» Find License Keys 





Attention: To generate license unlocking key(s) for SBR Carrier, proceed below. To generate license unlocking key(s) for OAC or SBR EE or SBR GE, please go to the PulseSecure 
(www PulseSecure net) license unlocking key page reached by accessing links found on httpJAwww junipernetsupportpulse html. To generate a license unlocking key for SBR Carrier Products 





please enter the Authorization Code. 
The Authorization Code can be found in the certificate you received when you purchased this feature. You will be presented with an unlocking key for the current shipping SBR Carrier Version. 
Note: You can generate an unlocking key for a downgrade version as you progress with license key generation. 


“indicates required items 





Authorization 
Code * 











For example, aBC1-D2eF-34Gh-5ijK 





Customer Email 
Address * 

















4. When the key is generated, a success screen is displayed. You can view the license online and record 
the key number, download it, or have it sent to the E-mail address you entered. 


